Practical Mobile Forensics - Fourth Edition

ADB backup extraction

Starting from Android 4.0, Google implemented the adb backup functionality, which allows users to back up application data to a computer using the adb tool. This process does not require root access and, hence, can be very useful during forensic examination. The main drawback is that it does not back up every application installed on the device. The backup feature is application dependent, as the owner of the application can choose to allow backups. Backups are allowed by default, but the developer can disable it if they want to. Hence, most third-party apps have this enabled and the adb backup command will work for them. Here is the syntax for the adb backup command:

adb backup [-f <file>] [-apk|-noapk] [-shared|-noshared] ...