Android 13 Image Now Available

After a very long data generation period I am happy to announce an Android 13 image with documentation is now publicly available for download.

This image contains 67 third party apps, all with varying levels (none to a lot) of data generated within.  All of the hits are there, along with some additions:  Whoop, Session, Slack, Mastodon, Gettr, BeReal, and Truth Social. A complete listing is in the documentation, which is available here. Additionally, there is a lot of location data in this image, and the phone was run using a physical SIM and eSIM simultaneously.

The image comes in two formats, a .TAR file and Cellebrite UFED Reader file. The UFED Reader file was generated from the TAR file. Forensic tools should be pointed at the TAR file, while the UFED Reader download should be decompressed twice (once from GZIP and once from the resulting TAR file).

This image is large (I think I said that with the Android 12 image, too).  The compressed TAR file comes in at ~18.47 gigabytes and ~32 gigabytes uncompressed. The UFED Reader file is ~15.24 gigabytes compressed and ~29.4 gigabytes uncompressed. Be prepared to kick off your download and walk away for a while. 

Both downloads were compressed using GZIP. The best way to decompress them are 7-ZIP (Windows) and Keka (macOS).

Hash values for the decompressed files are included in the documentation. Hash values for the downloads are as follows:

File Name: Android_13_Image – Data.tar.gz
MD5:
74B97F0AFE6CC0A79E81C39F3D01F4EF
SHA1:
4EA429DCF7D9BF7EDB7084A8AA867CDBADAEEC52
SHA256:
AEB95FE9ED2DABEFEF786C3DC620B0CD92255476C7A9BE01049CB05D995A39F9

File Name: Android_13_Image_Cellebrite_Reader.tar.gz
MD5:
FDFBA8B377B079B20BE8558D14517B07
SHA1:
363B66868DCF70B731EF4DCFC5C03FD485E5A318
SHA256:
6223A72A407B9B1526FBAE12D0878A22ED23490D4186D09C5E9AF90325B988B2

Google Takeout data (minus email) is also available for the account:

File Name: takeout-20221207T225040Z.zip
MD5:
4fa1ff29a13374d9aefeada67a153bfc
SHA1:
089b57baa0aa08d3d8bc1eca6edc5182fadb3496
SHA256:
831e2c23d7dd01c9689920b0191a93f7258dfaf7813e5c7937a8ecb0cc0392bd

All files can be downloaded from Digital Corpora.

***Please do not attempt to download any cloud data from any of the apps in the image.  If you want cloud data please contact me directly to discuss.***

As always, these images are freely available to anyone who wants them for training, education, testing or research.  If you do link, please link to this page and not the image URL. I will be moving this to Digital Corpora.

This is likely my last blog post of the year.  I want to thank everyone that has read any of the posts this year, and wish everyone a happy holiday season and Happy New Year!