Android ADB Backup

Android backups (.ab) are backups made by Android Debug Bridge (ADB). They are the preferred way of backing up an unrooted stock android device. (Manufacturers and/or carriers may provide their own backup tools). They can be encrypted (with AES) or unencrypted. They can be created via ADB backup and restored via ADB restore. Android backups themselves are .TAR files with a different header and no footer. Unfortunately, there are no graphical tools yet (other than mobile forensic tools like Cellebrite Physical Analyzer, Oxygen Detective, Magnet AXIOM, and MobilEDIT Forensics, which are all payed) that can extract them, and they require the command line. It is compressed via the DEFLATE method.

Header
 ANDROID BACKUP 1 1 none

Extraction
It is extremely hard to extract them, and for the best available tool you need the command line (and knowledge how to use it) and Java installed. Droid Explorer claims to be able to extract ADB backups, but there is no prompt of extraction and is a pain to install. Other command line tricks may also convert it to an easily extractable TAR.

Structucture
Contains all app data Contains app data Contains app APK (app file) (if requested) (/data/app/) Contains app files (/data/data/(package id)/files) Contains app SQLite databases (open them here) (/data/data/(package id)/databases) Contains app shared data (storage/emulated/0/Android/data/(package id) ) Contains app shared prefrences (app settings), usually xml files (/data/data/(package id)/shared_preferences) Contains app resources like webview data (like cookies) and texture cache (/data/data/(package id)/  Contains .obb files if specified in the backup (/storage/emulated/0/Android/obb/(package id) AndroidManifest.xml of the app Contains shared files (/storage/emulated/0/)

Flags
Backups all compatible apps Chooses the path and name for the file Backs up the stated package(s) if compatible. backups system apps if -all or a system package Id is stated. does not back up system data. Backs up the .apk of the app(s) does not back up apk files Backs up .obb (app extention) files Does not back up .obb files Backs up all shared storage (/storage/emulated/0/), including SD cards and USB OTGs, so it is recommended to eject and disconnect any external storage unless you want to back up that. does not back up shared storage. or  Backs up apps that support Key Value backups. Key value backups were added in Android 2.2 “Froyo”, and this flag was added in Android 8.0 “Oreo” (Even since Developer Preview 1) Does not back up key value apps.

Discontinuation
Android backups are being discontinued and fully replaced by Google Drive backups. Google drive backups cannot be downloaded, and there is a 25 MB per-app limit. You need a network sniffer to log upload traffic to capture these. The warning was there since the SDK of Android 10 “Queen Cake”, however, backups themselves weren’t changed. In Android 12 “Snow Cone”, apps with Snow Cone’s API level with backup flag set to true and a Snow Cone device will back up to (dumb) Google Drive instead.

Example
cats.ab: Extracted on a Galaxy Tab A with Android Nougat, Contains Android easter egg (com.android.egg) cats and render data.