# BACKUP FILE EXTENSION

**URL:** <https://sleuthkit.discourse.group/t/backup-file-extension/2154>\
**Category:** Autopsy Help\
**Created:** [September 16, 2020, 8:46pm UTC](https://sleuthkit.discourse.group/t/backup-file-extension/2154 "2020-09-16T20:46:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jacker](https://avatars.discourse-cdn.com/v4/letter/j/a5b964/32.png) [@Jacker](https://sleuthkit.discourse.group/u/Jacker)\
**Post date:** [September 16, 2020, 8:46pm UTC](https://sleuthkit.discourse.group/t/backup-file-extension/2154/1 "2020-09-16T20:46:28Z")

</div>

Hi,

I have rooted Samsung J3 phone. I would like to do forensics from backup. The problem is that which backup method I get correct backup extension so backup file is opened by Autopsy?

I have used TWRP backup, but Autopsy does not support this backup extension.

I would appreciate your help!

---

<div class="post-metadata">

**Author:** ![atdt0](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/atdt0/32/202_2.png) [@atdt0](https://sleuthkit.discourse.group/u/atdt0)\
**Post date:** [September 18, 2020, 1:55am UTC](https://sleuthkit.discourse.group/t/backup-file-extension/2154/2 "2020-09-18T01:55:17Z")

</div>

Hello.

For the Android backup, you will have to convert the .ab using something like Android Backup Extractor ([https://github.com/nelenkov/android-backup-extractor](https://github.com/nelenkov/android-backup-extractor)) and then you should be able to parse it with Autopsy. If you were able to TWRP the phone, were you able to use ‘dd’ or ‘dcfldd’ to get a physical image of the entire device? If you did then Autopsy will be able to parse that correctly.