Retrieve Data From Android Devices Without Rooting
By: Lam Pham
Tags: Android App Development, Android, AndroidDev, Android Security, Android Backup

Retrieve Data From Android Devices Without Rooting

Image by krzysztof-m from Pixabay

Android OS is designed to isolate the access to data of an application from others. Through linux-permission base, Android encloses application data and protects them from other users.

In other word, we can’t get data without launching the owner app or other apps which are allowed by the owner one.

Android inherits the set of features in Linux, including the power of a root user. However, unlike the root user in Linux which is normally assigned to the possessor of the device, the root user in Android doesn’t really “exist”.

To be more specific, by default, there is no way to execute some tasks as a root user on Android. Curious people have to find other ways to inject a root into the Android system.

This job is called rooting an Android device. To explain simply, the objective of rooting is to put a world-executable su binary in the system directory (system/bin or system/xbin).

By rooting a device, you get root privileges and are able to access all data in the device. This is the only way to retrieve data without launching application.

In fact, there is still another work-around that allows us to get access to the data stored in the device: “exploiting the Backup feature of Android”.

Exploiting the Backup feature to retrieve data.

Android provides a way to preserve data and restore them when users upgrade their devices. This function is no stranger to Android developers; we all know it as the effect of android:allowBackup attribute in AndroidManifest.xml file.

When android:allowBackup is set to true, backup process will be allowed to package the application data.

In other way, being able to launch this backup process and eventually obtaining the backup file are the key to get accessed to the data (only data of applications with android:allowBackup is true) in the device.

Indeed, adb helps us to do all these things.

Steps

Launch the backup process using adb backup command:

adb backup com.application.id

You can choose to backup a specific application or the whole device with - all option.

The Android device will be prompted to the permission and an encryption password. Choose a password and remember it for later decryption.

Android Backup prompt

The backup file will be created under the name backup.ab .

. Use Android backup extractor to extract .ab file to .tar file:

java -jar abe.jar unpack backup.ab backup.tar {password}

{password} is the one chosen in the previous step.

Unpack or read backup.tar file using tar command.

tar xvf backup.tar

You will get a folder named apps which looks like this:

Unpack a backup file

We can see the Databases and Sharepreferences (if exist) in db and sp folders respectively.

Note that if the application doesn’t allow to backup data ( android:allowBackup is set to false), you will see nothing in backup.tar file.

If you are lucky, you may get something like this:

Interesting, right?

Backup pitfalls?

As we have discussed above, Backup exposes app data which is meant for app’s usage only.

Backup sometime causes irregular behaviors for users because it reapplies, without user’s awareness, the backup data (if exist) every time the app is removed then reinstalled.

What do we do as Android developer?