Android Verified Boot Metadata (vbmeta)
| Format | Android Verified Boot Metadata (vbmeta) |
|---|---|
| Short name | vbmeta |
| Category | disk_image |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Signed metadata of Android Verified Boot 2.0, stored in the vbmeta partition or embedded in other partitions, which then carry a 64-byte 'AVBf' footer at their end. The vbmeta image contains the rollback index, flags, the public key and descriptors (hash, hashtree, chain partition and property descriptors) with the expected digests of the verified partitions. Flags such as disabled hashtree or disabled verification indicate a modified boot chain, as commonly set on unlocked or rooted devices.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 56 42 30 | AVB0 | vbmeta image magic 'AVB0' |
| offset unknown | 41 56 42 66 | AVBf | Footer magic 'AVBf' in the last 64 bytes of a partition with embedded vbmeta |
Known extensions
None recorded
References
- Android Verified Boot 2.0 README (AOSP) https://android.googlesource.com/platform/external/avb/+/refs/heads/main/README.md
Cite this entry
Crush Format Reference, “Android Verified Boot Metadata (vbmeta)”. https://kalink0.github.io/crush-forensics/formats/vbmeta/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction