Analysing (no-root) android backup.ab files

Autopsy Help
1

Hello group,
is there anybody who could help me with adding a (non-rooted) adb backup file from andriller (or adb) sucessfully to Autopsy 4.14.0.
When using the recomended way as “Disk Image or VM File” I get 1. Cannot determine file system type (Sector offset: 0)
When using as “Logical Files” (after converting it to a tar and extract content, no real usable data, like GPS, call logs, etc. is extracted. Except for callendar entries.

Rooting is actually not an option to avoid tainting the original source.

I’d really appreciate some help in a forensical examination of un-rooted androids.

Thx for your help. In return I’ll be happy to create a HowTo for public reference of the solution. :wink:
Marcus

2

Android backups are a modified TAR archive.

Therefore, if you try to add it as a Disk Image or VM File, you will get the “cannot determine file system” error because that method looks for file systems in disk partitions.

If you try to add the backup as a Logical File, it will not be recognize as a TAR archive because it has a different header than a standard TAR file.

I’d suggest an Internet search for how to convert or unpack an Android backup, then add the converted file or extracted backup as a Logical File.