Learning Android Forensics - Second Edition

Dumpsys conclusions

Running the dumpsys command with no service name will run dumpsys on all available services. However, the output will be very large and should be redirected into a text file. On most platforms, the command to do this would be the following:

adb shell dumpsys > dumpsys.txt

This would write the output to dumpsys.txt in the current working directory. The output can then be searched or a parsing script can be run to pull out known relevant fields.

Dumpsys is an extremely powerful tool that can be used to show information that cannot be obtained elsewhere on the device. We recommend running dumpsys on every Android device when it is seized, prior to being shut down. This will save a wide variety of information that may be useful ...