Practical Mobile Forensics - Fourth Edition

Secure USB debugging bypass using ADB keys

As mentioned earlier, while using USB debugging, if the Always allow from this computer option is checked, the device will not prompt for authorization in the future. This is done by storing certain keys, namely adbkey and adbkey.pub, on the computer. Any attempt to connect to adb from an untrusted computer is denied. In this case, the adbkey and the adbkey.pub files can be pulled from the suspect's computer and copied to the investigator's workstation. The device will then assume that it is communicating with a known, authorized computer. The adbkey and adbkey.pub files can be found at C:Users<username>.android on Windows machines.