Android Keystore
| Format | Android Keystore |
|---|---|
| Short name | Keystore |
| Category | database |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Android's credential and key storage system. Two distinct layers: (1) App-level keystore files — BKS (Bouncy Castle KeyStore) or PKCS#12/PFX files bundled in APKs for certificate pinning and SSL. BKS files contain certificates, private keys, and trust anchors; their passwords are frequently hardcoded in app code. (2) System Keystore — keys generated through Keymaster/KeyMint in the TEE or StrongBox are stored as wrapped key blobs under /data/misc/keystore/: up to Android 11 as one file per key in user_<N>/ named after the owning UID and alias, since Android 12 (keystore2) in the SQLite database persistent.sqlite. The key material cannot be used off the device, but aliases, owning UIDs and certificates remain readable. App keystore files (.bks, .keystore, .p12, .pfx) are found bundled in APK assets/ or res/raw/ directories. App keystores can also be JKS/JCEKS; see Java KeyStore. BKS has no magic and begins with its version number; PKCS#12 is DER (ASN.1 SEQUENCE, 0x30). Hardcoded keystore passwords in decompiled DEX are a common finding in mobile app security assessments.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 30 | 0 | PKCS#12/PFX — ASN.1 SEQUENCE tag (too generic to match on) |
Known extensions
.keystore, .bks, .p12, .pfx
References
- Android Keystore system (Android developer docs) https://developer.android.com/privacy-and-security/keystore
- keystore2 database schema (AOSP system/security, database.rs) https://android.googlesource.com/platform/system/security/+/refs/heads/main/keystore2/src/database.rs
- PKCS#12 format overview (Wikipedia) https://en.wikipedia.org/wiki/PKCS_12
- Mind Your Keys? A Security Evaluation of Java Keystores (NDSS 2018) https://www.ndss-symposium.org/wp-content/uploads/2018/02/ndss2018_02B-1_Focardi_paper.pdf
Cite this entry
Crush Format Reference, “Android Keystore”. https://kalink0.github.io/crush-forensics/formats/keystore/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction