Android OAT/ART
| Format | Android OAT/ART |
|---|---|
| Short name | OAT/ART |
| Category | execution |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Android Runtime (ART) ahead-of-time compiled code artifacts introduced with Android 5.0 (Lollipop). Three file types form a triplet per app: .odex/.oat (ELF binary with AOT-compiled native code from dex2oat), .vdex (verified DEX bytecode — contains a copy of the original DEX since Android 8.0), and .art (optional ART heap image for fast startup). Presence of an .odex/.oat file shows the app was compiled for the device; it does not by itself prove execution (preinstalled apps are compiled when the system image is built). Prior to Android 8.0, the OAT file itself contained an embedded DEX copy — useful for recovering app code when the original APK is absent. Stored under /data/app/<package>/oat/<arch>/ for user apps, in an oat/ directory next to preinstalled system apps, and in /data/dalvik-cache/. File timestamps of these artifacts indicate when the app was last installed or (re)compiled.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 6F 61 74 0A | oat. | OAT header magic inside the ELF 'oatdata' section (.oat/.odex files are ELF binaries) |
| offset 0 (0x0) | 76 64 65 78 | vdex | VDEX file magic |
| offset 0 (0x0) | 61 72 74 0A | art. | ART image file magic |
Known extensions
.oat, .odex, .vdex, .art
References
- ART configuration and file types (Android AOSP) https://source.android.com/docs/core/runtime/configure
- Android OAT/VDEX/DEX/ART formats (LIEF documentation) https://lief.re/doc/latest/tutorials/10_android_formats.html
- Android compilation process and binaries (APK, DEX, OAT, ODEX, VDEX, ART) https://github.com/connglli/blog-notes/issues/35
Cite this entry
Crush Format Reference, “Android OAT/ART”. https://kalink0.github.io/crush-forensics/formats/oat-art/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction