Android AntiForensic Tools is a free and open-source application designed to protect your personal data from a powerful adversary who can pressure you to unlock your device. Its purpose is to irreversibly destroy your sensitive data in the event of danger, to do so completely invisibly to the human eye, and, as far as possible, to try to do so imperceptibly to forensic experts. It allows you to wipe the device, user profiles, or personal files when a duress password is entered, a USB device is connected, device buttons are pressed several times in a row, or the wrong password is entered multiple times. The application offers additional options to protect your device from advanced adversaries: it can uninstall itself, run TRIM after data deletion to prevent recovery of deleted data, disable logs to leave no traces of its actions, and disable safe boot mode. Features and limitations I was inspired to create this app by the Wasted app by x13a. It allows you to factory reset the device when a duress password is entered, a USB device is connected, or other triggers are activated. Wasted is a big step forward for anti-forensics on Android devices, and in some situations, it can be useful, but Wasted has some limitations: Wiping device data is obvious to an adversary. That can provoke him and lead to unpredictable consequences for the user as described in this blog post (on russian). The protection can be bypassed by booting the device into safe mode, where user apps are disabled. The application destroys all user data. The application does not work on Android 14 and above. Wasted used wipeData, which cannot be called from the primary user on Android 14+. To perform a hard reset on newer Android versions you must call wipeDevice method, but it is only available to the application with device owner rights - and Wasted only uses admin privileges. My app is designed to address these shortcomings. It allows wiping data on newer Android versions without root privileges by using Dhizuku, an app for handing over device owner rights to other apps. This app can prevent boot into safe mode. Most importantly, it enables more stealthy data destruction: instead of performing a full factory reset, the app can delete a single user profile or specific user files. Once all operations are complete, the application can delete itself. There are limits to the stealthiness of data deletion. After data is removed, traces often remain in logs, caches, statistics, and other system places. It is nearly impossible to erase all such traces, and a determined adversary with full device access can detect them. Some traces are more or less harmless — you can plausibly explain a deleted Android profile — but other traces can reveal that data was recently deleted using this application and may increase an adversary’s interest in extracting the truth. I continually work to reduce these traces. The app includes some options to hide its presence, obscure traces of deleted data, and conceal the app’s role in data removal. However, the study of traces of deleted data is still far from complete. Another disadvantage of the app is that its most advanced features, including self-destruction, require root permissions to function properly. Granting root permissions increases the attack surface and can make you more vulnerable to certain types of attacks. As an alternative to rooting your device, you can use the app with Dhizuku and Shizuku, though using this methods may also introduce new attack vectors. However, features like self-destruction and TRIM may be less reliable due to limitations inherent in these apps.