Mobile evidence shows up in almost every serious case now, and the tooling gap is still real. Commercial suites are expensive and opaque. Open-source options often extract everything into an unreviewable pile or require a fragile runtime before an investigator can even start.
ARCHON is the Android forensics tool I wanted during digital investigations: modular, fast, and honest about what it is doing. Each data type is its own extractor. SMS, calls, contacts, media, location, WiFi, Bluetooth, and related artifacts can be selected instead of dumped blindly. Parallel extraction, SHA-256 hashing, chain-of-custody metadata, and native egui views make it feel like a product rather than a script.
The rest of the product is built around review. Timeline views, relationship graphs, hex inspection, dashboards, and report generation turn the extraction into something an analyst can navigate. Reports can leave the tool as PDF, HTML, Markdown, JSON, or CSV with verification hashes and case metadata.
Rust was a practical choice. A single binary, lower memory use, compile-time safety, and async extraction are the right tradeoffs for a tool that may be handed to an investigator under time pressure. WhatsApp, Signal, and deeper recovery stay on the roadmap; the foundation is the part that makes the roadmap believable.