Skip to content

ADB Backup

Definition

An Android Debug Bridge backup produced by the adb backup command. The output is a TAR archive prefixed by a small plaintext header specifying version, compression, and encryption status. Each entry in the archive corresponds to an app's data directory or external storage content.

Tool
Android Debug Bridge, adb backup command
Output format
TAR archive
Header
Plaintext, states version, compression, encryption
Contents
Per-app data directory and external storage content

Common questions

Why does the plaintext header of an ADB backup matter to an examiner?+

It reveals immediately whether the archive is encrypted or compressed before any extraction attempt, letting the examiner choose the correct decryption or decompression tool rather than guessing at the archive format.

Does an ADB backup capture the same data as a full physical device image?+

No, it is limited to data the backup mechanism and individual apps expose through their backup agents, so it typically misses system partitions and app data that developers have flagged as excluded from backup.

Related terms

allowBackup Flag
An Android manifest attribute (android:allowBackup) that controls whether an app's data is included in ADB backups. When set to false the app's...
Backup Keybag
A data structure in iOS encrypted backups that holds the per-class encryption keys used to protect individual files. The keybag itself is...
CLOUD Act
The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
Domain (iOS Backup)
A prefix in the iOS backup manifest that identifies the origin of each backed-up file. Common domains include HomeDomain (the device home...
Manifest.db
The SQLite database at the root of every iTunes local backup. It maps each backed-up file to its SHA-1 hash filename, recording...

Explained in

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.