Extracting private data from Android apps

Occasionally, an android application will store data inside its private data store, and not make that data visible to other applications. Sometimes you really really WANT to access that data (such as an ISS transit of the sun which you recorded).  It is possible to use debugging mode to “back up” the apps data, and then extract the backup file to get access to the individual files.  Here is an example of doing this, using the Zwo Seestar app as my example.

1. Enable USB Debugging on your android device (if you don’t know how to do this, the following steps will be even harder, and this procedure may not be for you unless you really want to learn a lot).

2. Connect to your android device using a computer, verifying the connection with adb devices.

3. Backup the specific application you are interested in. To do this you must know the application ID (can be found in the URL at the Google Play store website). For my example, this is: com.zwo.seestar
Start the backup with this command:

adb backup -f myAndroidBackup.ab com.zwo.seestar

Your android device will ask if you want to do the backup and optionally allow you to enter a password to encrypt the backup (don’t do this if you value your sanity…)
You will have to press a button to allow the full backup, and the command may take many minutes depending upon the application size.

4. When the command is finished, you will be left with the myAndroidBackup.ab file. You will need to figure out a way to convert this to a tar file and decompress/extract it. On my Linux computer (Ubuntu 22.04) the following command accomplished this:

( printf "\x1f\x8b\x08\x00\x00\x00\x00\x00" ; tail -c +25 myAndroidBackup.ab ) | tar xfvz -

5. You now have a directory tree which includes all of your application files. In my case, I found the video file I was looking for in the apps/zwo.com/seestar/f/video_image folder.

You can see the resulting video here: https://youtube.com/shorts/A4q-SaZfbaI?si=nYYYo-IykesKJWSz

 

Leave a Reply

Your email address will not be published. Required fields are marked *