Dumpsys is a tool built into the Android OS, generally used for development purposes to show the status of services running on the device. However, it can also contain forensically interesting information. Dumpsys does not require root access, but, like all ADB commands, does require USB Debugging to be enabled on the device and Secure USB Debugging to be bypassed.
The exact services that can be viewed differ across devices and Android versions. To view a list of all possible services that can be dumped, run the following command:
adb shell service list
The output of the command will appear as a list, as shown here:
The service name located before the colon is the argument we will pass to dumpsys. A valid dumpsys command, using the previously seen service number seven (iphonesubinfo), looks like this:
adb shell dumpsys iphonesubinfo
In the following, we see that...
