One year after our first announcement, Bugbane, our open-source app for consensual Android forensics, is now available as an open beta, with its own dedicated website: bugbane.org. Anyone can install it and test it on their Android device. The documentation is still a work in progress, but it’s already available with some additional information.
Beta builds are available on F-Droid and Google Play, or directly from GitHub releases. We are now looking forward to feedback from a much wider audience.
Help us make it better #
This is a beta: things will break, and that’s exactly what we want to hear about. Please open issues on GitHub for bugs, usability problems, or feature requests. If you speak a language we don’t, you can help localize Bugbane on Weblate.
We have many features in mind for the coming months, but we took our time getting here on purpose: we wanted the app to be more secure, and to stay well compatible with the MVT ecosystem, before putting it out.
The nerdy details #
Keeping up with MVT and AndroidQF #
Bugbane produces AndroidQF-compatible acquisitions, so anything Bugbane collects can be analyzed with MVT. Both MVT and AndroidQF have been evolving quickly lately, which is great news for the ecosystem — and we warmly welcome any effort to standardize the acquisition format. Practically, this means Bugbane will lag slightly behind upstream MVT/AndroidQF development: when new modules are added there, expect some delay before they land in Bugbane.
Fancy encryption #
Each acquisition is a standard ZIP archive wrapped in an age encryption envelope, encrypted as it is written so that plaintext is never cached on storage, not even temporarily. The age identity is an X25519 key pair whose private key is wrapped by a key held in the device’s security hardware (a StrongBox secure element where available, otherwise the TEE), and unwrapping it requires confirming your screen lock.
On top of that, users can set an optional password, which adds a second layer inside the hardware-backed one: the key is sealed with Argon2id and ChaCha20-Poly1305. This double encryption is specifically designed against non-consensual forensic extraction: tools like Cellebrite typically work by extracting key material and brute-forcing short PINs, and even if that succeeds against a device, a long password behind Argon2id remains impractical to crack. The trade-off is real, though — Bugbane never stores the password, so forgetting it means those acquisitions stay sealed forever.
The wireless ADB CVE #
Bugbane relies on Android’s Wireless Debugging, so CVE-2026-0073 matters to us: an authentication bypass in the wireless ADB certificate verification that allowed an attacker on the same network to obtain code execution as the shell user on Android 14–16. Google fixed it in the May 2026 security bulletin. Bugbane attempts to detect unpatched devices and warns users accordingly; if your device cannot receive the patch, use Bugbane only on an isolated network such as a personal hotspot. This and other trade-offs are discussed in the risks and warnings page of the documentation — please read it before relying on the app.
Thank you #
We are grateful to Rowen S for their development work and contributions to Bugbane.
We also thank NLnet for supporting Bugbane’s development with a dedicated grant from the NGI Mobifree Fund.
