Android Backup Archive

Format	Android Backup Archive
Short name	Android backup
Category	archive
Platforms	Android
Crush support	Supported `(AndroidBackupVFS)`
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Backup created via ADB backup functionality (deprecated; restricted since Android 12 / API 31). The archive is a TAR stream compressed with Deflate, optionally encrypted with AES-256. Contains app data, shared storage, and system settings depending on app configuration. Forensically relevant as a logical acquisition path — but significantly limited: apps setting allowBackup=false (e.g. banking, messaging) are excluded, and apps targeting Android 12+ are automatically excluded. Can reveal installed app data, preferences, and media for apps that permit backup.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 0 (0x0)	41 4E 44 52 4F 49 44 20 42 41 43 4B 55 50 0A	ANDROID BACKUP.	Android backup header

Known extensions

.ab

References

AOSP source (BackupManagerService, Android 4.1 original implementation) https://android.googlesource.com/platform/frameworks/base/+/refs/heads/jb-dev/services/java/com/android/server/BackupManagerService.java
Android 12 behavior changes — adb backup restrictions https://developer.android.com/about/versions/12/behavior-changes-12
Android Backup Extractor (ABE) https://github.com/nelenkov/android-backup-extractor
Format internals (Nikolay Elenkov) https://nelenkov.blogspot.com/2012/06/unpacking-android-backups.html
ADB backup forensic acquisition (Andrea Fortuna) https://andreafortuna.org/2017/12/29/forensic-logical-acquisition-of-android-devices-using-adb-backup/

Cite this entry

Crush Format Reference, “Android Backup Archive”. https://kalink0.github.io/crush-forensics/formats/android-backup/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction