LockKnife

Create a case first, replace EXAMPLE_DEVICE_SERIAL with your authorized device's serial, and substitute the input paths with your evidence files.

lockknife --cli extract browser --serial EXAMPLE_DEVICE_SERIAL --app chrome --kind history --case-dir ./cases/EXAMPLE_CASE
lockknife --cli extract messaging --serial EXAMPLE_DEVICE_SERIAL --app whatsapp --case-dir ./cases/EXAMPLE_CASE
lockknife --cli forensics sqlite ./example-evidence/messages.db --case-dir ./cases/EXAMPLE_CASE
lockknife --cli forensics correlate --input ./example-evidence/artifacts.json --case-dir ./cases/EXAMPLE_CASE

Acquisition depends on permissions, app versions, and encryption. Protected paths may require root; collecting an encrypted database does not decrypt its messages. Carved records are recovery candidates, not automatic proof of deletion.

lockknife --cli apk decompile ./example-app.apk --mode auto --output ./example-decompiled
lockknife --cli apk scan --apk ./example-app.apk --yara ./example-rules/example.yar

Automated security findings require review. Archive unpacking is not source-code reconstruction.

lockknife --cli runtime bypass-ssl com.example.placeholder --device-id EXAMPLE_DEVICE_SERIAL --case-dir ./cases/EXAMPLE_CASE
lockknife --cli runtime memory-search com.example.placeholder --device-id EXAMPLE_DEVICE_SERIAL --pattern "EXAMPLE_SEARCH_TEXT"

Frida requires a compatible target server and sufficient permissions. Built-in hooks depend on the app implementation and can change its behavior. Explicitly stop active sessions when your work is complete.

lockknife --cli network api-discovery ./example-evidence/capture.pcap --case-dir ./cases/EXAMPLE_CASE
lockknife --cli security scan --serial EXAMPLE_DEVICE_SERIAL

Device capture requires accessible on-device tcpdump. Encrypted traffic may conceal endpoints and payloads; reported device properties do not independently establish hardware security.

lockknife --cli crack pin --hash EXAMPLE_SHA1_HASH --algo sha1 --length 4
lockknife --cli crypto-wallet scan-device --serial EXAMPLE_DEVICE_SERIAL --case-dir ./cases/EXAMPLE_CASE

EXAMPLE_SHA1_HASH is a placeholder, not a usable hash. Replace it with the 40-character hexadecimal SHA-1 value you are authorized to test. Credential tools support specific legacy hashes and accessible artifacts; they do not guarantee recovery of modern Android screen locks or hardware-backed private keys. Wallet workflows depend on the supported app format and available data.

Download the matching wheel from GitHub Releases. Use Python 3.12 or newer:

python -m pip install /path/to/EXAMPLE_WHEEL.whl

Choose a wheel matching the operating system and architecture listed above.

/path/to/EXAMPLE_WHEEL.whl is a dummy path. Replace it with the full path and filename of the wheel you downloaded.

For wheel installations, select the extras you need:

python -m pip install '/path/to/EXAMPLE_WHEEL.whl[apk,network]'
python -m pip install '/path/to/EXAMPLE_WHEEL.whl[full]'

External tools still apply: JADX/apktool for decompilation, a target Frida server for instrumentation, and device tcpdump for capture. PDF rendering and Bleak are separate dependencies, not included in full. Install optional Python dependencies in the environment containing LockKnife, not an unrelated system Python.

lockknife --cli --help
lockknife --cli features
lockknife --cli actions --format json

Use --help on an individual command to see its options. Prefer numbered menus? Run lockknife --cli interactive and follow the classic menu guide.

Not for offline analysis or case review. You can inspect local SQLite databases, APKs, PCAP files, and supported exported artifacts. Device-backed operations need a connection; protected app and system paths often need elevated access.

No. Credential recovery supports specific hashes and accessible artifacts. Modern hardware-backed credentials, encryption, and device protections cannot be assumed recoverable or bypassable.

Some workflows need optional dependencies, external tools, provider credentials, or target permissions. Run lockknife --cli doctor and lockknife --cli features to check requirements before starting.

Local analysis does not require threat intelligence services. Explicit external lookups send selected indicators to their providers. Review your data-sharing policy and the case privacy guide before using those integrations.