Android OTA Update Payload (payload.bin)
| Format | Android OTA Update Payload (payload.bin) |
|---|---|
| Short name | payload.bin |
| Category | archive |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The update payload of Android A/B (seamless) updates, usually named payload.bin inside an OTA ZIP. A big-endian header with major version and manifest size (and, in version 2, the metadata signature size) is followed by a protobuf manifest that describes target partitions and install operations, and by the operation data. Full payloads contain complete partition images; delta payloads only differences to a specific source build. Payloads are used to obtain partition images and to identify the exact firmware build of a device.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 43 72 41 55 | CrAU | Payload magic 'CrAU' |
Known extensions
None recorded
References
- update_engine README — update payload file specification (AOSP) https://android.googlesource.com/platform/system/update_engine/+/HEAD/README.md
Cite this entry
Crush Format Reference, “Android OTA Update Payload (payload.bin)”. https://kalink0.github.io/crush-forensics/formats/payload-bin/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction