ADB backup (Import)

To import an ADB backup into MOBILedit Forensic, follow these steps:

1. Select the “Android ADB backup file”, which has an “.ab” file extension.

2. Import the selected file into MOBILedit Forensic. The Android ADB backup file will have an “.ab” file extension.

3. If the backup is protected by a password, enter the same password when prompted by MOBILedit Forensic.

If the ADB backup has been successfully imported it will be shown in the logging window as below:

Then, a Logical extraction and analysis report can be confirgured.

ADB backups - General information

An Android ADB (Android Debug Bridge) backup typically includes various categories of data and artifacts from the device. However, the specific data included can vary depending operating system version in which it was created and various other factors.

Generally the following can be included in an ADB backup:

• System applications and data

• 3rd party applications and data

• Shared storage

An ADB backup can include the following categories:

1. App Data:

   • User app data (e.g., settings, databases, shared preferences, files within the app's private storage)

   • App-specific data (e.g., cache, logs)

   • App APK files

2. System Data:

   • System settings and configurations

   • System app data (limited by permissions)

3. User Data:

   • Contacts

   • Call logs

   • SMS/MMS messages

   • Calendar events

   • Browser data (e.g., bookmarks, history)

4. Multimedia Files:

   • Photos and videos (typically stored in the DCIM folder)

   • Music and audio files

5. Documents and Downloads:

   • Files in the Downloads folder

   • Documents and other user-created files

6. Other Data:

   • Wi-Fi network settings and passwords

   • Bluetooth pairings

   • Certain configuration files

Not all data might be backed up due to various limitations:

• Some applications may restrict or encrypt their data, making it inaccessible for ADB backups.

• Certain system data and settings might be excluded for security reasons.

• Data stored in some apps' private storage might not be included if the app is designed to prevent such backups.

ADB backup - Encryption

The amount of data in an encrypted ADB backup is the same as in an unencrypted ADB backup. The difference lies in the security of the data rather than the quantity or type of data included. Encryption ensures that the data is secure and can only be accessed with the correct password, but it does not add additional data to the backup file.