ART
Definition
Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for faster startup and lower memory pressure.
- Full name
- Android Runtime
- Replaced
- Dalvik virtual machine
- Introduced
- Android 5.0 Lollipop
- Compile model
- Ahead-of-time (AOT) at install
- Output file
- OAT file
Common questions
Why does an examiner need to know whether a device runs ART or Dalvik?+
AOT-compiled OAT files and their install-time metadata can carry timestamps and artefacts distinct from Dalvik's just-in-time bytecode, which affects how app installation history and file provenance are reconstructed during mobile forensics.
Does ART change how app data itself is stored?+
No. ART changes how app code is compiled and executed, not the app's own databases, shared preferences, or files, which forensic acquisition still targets through the standard Android filesystem locations.
Related terms
- APK / IPA
- Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and...
- FBE
- File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE)...
- Secure Enclave
- The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...
- WAL
- Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database....