Realm Database
| Format | Realm Database |
|---|---|
| Short name | Realm |
| Category | database |
| Platforms | Windows, macOS, Linux, iOS, Android |
| Crush support | Supported (RealmParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Mobile app local object store used as a SQLite alternative, marketed by MongoDB as Atlas Device SDK until its deprecation in 2024. A single '.realm' file stores all object data in a B+ tree of fixed-size arrays. The file holds the full schema (class/table names such as 'class_Driver', 'class_Event', 'class_Photo'). The header contains two root references (top_ref[0] / top_ref[1]) used for copy-on-write commits — a flag selects the active one, the inactive one points to the previous commit and may still reference superseded data. Class names reveal which app features were in use and what data categories are present (users, locations, media, events, etc.). Some Realm databases are AES-256 encrypted — key material may be hardcoded in the app binary or kept in the Keychain/Keystore.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 16 (0x10) | 54 2D 44 42 | T-DB | Realm header mnemonic (T-DB) |
Known extensions
.realm
References
- Realm Studio (open .realm files) https://www.mongodb.com/docs/atlas/device-sdks/studio/open-realm-file/
- Realm forensics primer (Alexis Brignoni) https://abrignoni.blogspot.com/2019/11/realm-database-storage-primer-for.html
- The Realm Files - Vol 3 - The Realm Header (Damien Attoe) https://digital4n6withdamien.blogspot.com/2026/01/the-realm-files-vol-3-realm-header.html
- The Realm Files - Vol 2 - Physical Structure Overview (Damien Attoe) https://digital4n6withdamien.blogspot.com/2025/11/the-realm-files-vol-2-physical.html
- Methods for recovering deleted data from the Realm database (Kim et al., FSI: Digital Investigation, 2022) https://www.sciencedirect.com/science/article/abs/pii/S2666281722000221
- Mobile Forensics – The File Format Handbook: Realm (Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_8
- Object by Object — RealmDB Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/object-by-object-realmdb-forensics-with.html
Cite this entry
Crush Format Reference, “Realm Database”. https://kalink0.github.io/crush-forensics/formats/realm/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction