UsRT - Graphical interface for Android Usagestats and Recent Tasks XML parsers.

Introducing UsRT

Thanks to the hard work of Chris Weber (@RD4N6) we now have a way to parse the essential data contained in the Android Usage Stats and Recent Tasks XML files through a graphical interface. Like Eric Zimmerman says it is agent proof. Chris took my scripts, based on the research done by Jessica Hyde (@B1N2H3X), and made them accessible to all. Point and click goodness.

The application can be run as an executable (UsRT.exe) via the provided installer or through the python scripts directly. The installer has all dependencies included and is the easiest and fastest way to use the parser.

For details on the original research that motivated these scripts and the interface see Jessica Hyde's research at the SANS DFIR Summit 2018. For details on the parsing scripts see my previous blog posts for Usage Stats and Recent Tasks.

Script and installer links at the end of the blog post.

Features for Usage Stats:

• Case information fields

• Visual listing of files as they are processed in the left bottom corner of the interface

• Rows and columns format with the ability to hide columns and select all rows, check rows or unchecked rows.

• HTML reporting

• Ability to open already processed cases through the application generated case json file.
• Included Read Me file that has a quick overview on usage with related screenshots. The Read Me can be accessed via the Help menu options.

Features for Recent Tasks:

• Same features as Usage Stats with the addition of the recent images and snapshot fields. Pressing on the images will show them in your system's default image viewer. HTML reporting include images as well.

Repository and installer

To get the scripts go to the following repository:

https://github.com/abrignoni/UsRT

The installer is in the same repository in the release tab.

https://github.com/abrignoni/UsRT/releases 

Conclusion

As said at the beginning of the post I am indebted to Jessica Hyde for doing the original research and to Chris Weber for putting all work an effort to maximize the use of the parsing scripts by making an awesome graphical interface for them.

As always I can be reached on twitter @AlexisBrignoni and email 4n6[at]abrignoni[dot]com.