How to Extract Sandbox Data of an Android App

One of my beta testers reported a crash in the production build. I went through the code and couldn't reproduce it locally. After a while I started to suspect cached data in the app's sandbox, so I decided to pull that data off the device and have a look.

There are a few ways to approach this:

Root the device and open the sandbox with a file explorer. It works, but it breaks the device's security, so I wouldn't do it on a real phone. You can do it on an emulator, but it takes more setup.
Use ADB (Android Debug Bridge). It's cleaner, doesn't change anything on the device, and it's what I'd recommend.

ADB is the command-line tool for talking to a connected Android device. You can use it to install and debug apps, and to open a shell on the device and run commands.

The process has two steps:

Get a backup from the desired application.
Extract the backup file.

Step 1: Get a Backup from the Application

First, confirm your device is connected:

adb devices

Then create a backup of the target app (without the APK itself):

adb backup -noapk <packageName>

The backup file will be generated in the current directory of your terminal with the extension .ab.

Step 2: Extract the Backup File

The .ab file is compressed with DEFLATE, and encrypted with AES if you set a password. To unpack it, you'll need a tool like android-backup-extractor.

Navigate to the extractor directory and run:

java -jar abe.jar unpack <path/to/backup.ab> <path/to/backup.tar> ""

That gives you a backup.tar you can open with any archive tool. Inside is everything in the app's sandbox: databases, shared preferences, cached files.

Update: I wrote this in 2020. Since Android 12, adb backup no longer includes app data for apps that target Android 12 or higher, unless the build is debuggable. For newer apps, use a debug build or adb shell run-as <packageName> to read the files.

Hope this helps next time you're chasing a ghost crash. Have feedback or questions? Feel free to reach out on Twitter.