In the past, very few, if any, Android devices come with netcat installed. To check, simply open the ADB shell and type nc. If it returns saying nc is not found, netcat will have to be installed manually on the device. netcat, compiled for Android, can be found in many places online; for example, at https://github.com/MobileForensicsResearch/netcat.

If we look back at the results from our mount command from the previous section, we can see that the /dev partition is mounted as tmpfs. The tmpfs is a Linux term meaning that the partition is meant to appear as an actual file system on the device, but is truly only stored in RAM. This means that we can push netcat here without making any permanent changes to the device, using the following command on the examiner's computer:

adb push nc /dev/Examiner_Folder/nc

The command should have created the Examiner_Folder in /dev, and nc should be in it. This can be verified by running the following command in the ADB shell:

ls /dev/Examiner_Folder

In current versions of Android (starting from Marshmallow), Toybox—a free and open source software implementation of some Unix command-line utilities, including netcat—is already installed, so an examiner doesn't need to install it.