Sometimes you need to tweak an app’s internal files – for example, change a hidden setting, fix a corrupted SQLite database, or replace a configuration XML. Doing this without rooting the device is possible, but it requires a careful workflow that preserves data integrity and respects Android’s security model. This tutorial walks you through the entire process: creating a backup with adb, converting the backup to a manipulable archive, editing the files you need, repackaging the data, and finally restoring it to the device.
com.example.app identifier. You can find it in Settings > Apps or by running adb shell pm list packages | grep part‑of‑name..ab backup. Most Linux/macOS systems have it; Windows users can install the binary from https://slproweb.com/products/Win32OpenSSL.html.When you connect the phone to the PC for the first time after enabling debugging, a dialog will ask you to Allow USB debugging? Confirm and optionally tick “Always allow from this computer”.
Open a terminal (Command Prompt, PowerShell, or a Linux shell) and run:
adb devices
You should see a line with your device’s serial number followed by device. If you see unauthorized, check the phone screen for the confirmation dialog.
The adb backup command creates a single .ab file that contains the app’s private data. The command syntax is:
adb backup -f <output_file.ab> -noapk -nosystem <package_name>
Explanation of the flags:
-f – Destination file on the PC.-noapk – Skip the APK itself; we only need the data.-nosystem – Exclude system apps (saves space).Example – backing up the app com.example.notes to notes_backup.ab:
adb backup -f notes_backup.ab -noapk -nosystem com.example.notes
After you run the command, the phone will display a “Full backup” screen. You can set a password (recommended) or leave it blank for an unencrypted backup. Remember the password if you set one – you’ll need it later.
The backup process can take a few seconds to a few minutes depending on the size of the app’s data.
.ab file to a standard .tar archiveThe .ab format is a simple wrapper around a tar archive, optionally encrypted with OpenSSL’s aes‑256‑cbc. To unpack it, follow these steps:
notes_backup.ab.openssl aes-256-cbc -d -in notes_backup.ab -out notes_backup.tar -pass pass:YOUR_PASSWORD
Replace YOUR_PASSWORD with the actual password. If you left the backup unencrypted, skip the OpenSSL step and extract directly (see below).dd if=notes_backup.ab bs=24 skip=1 of=notes_backup.tar
This command works on Linux/macOS. Windows users can use certutil -decodehex or install a Unix‑like environment such as Cygwin.Now you have notes_backup.tar, a regular tar archive that can be opened with any archive manager.
Run:
tar -xf notes_backup.tar -C notes_backup
This creates a folder notes_backup containing the app’s data hierarchy. The structure mirrors the device’s internal storage layout, typically:
apps/com.example.notes/
Inside you’ll find subfolders such as files/, shared_prefs/, databases/, and possibly cache/. These are the locations you can edit.
What you edit depends on the problem you’re solving. Below are three common scenarios.
SharedPreferences are stored as XML under shared_prefs/. Open the file with any text editor.
<?xml version="1.0" encoding="utf-8"?>
<map>
<string name="username">old_user</string>
<int name="launch_count" value="42" />
</map>
Change the values you need – for example, set username to new_user. Save the file and keep the same filename.
Databases reside in databases/ and usually have a .db extension. Use a desktop SQLite browser:
.db file.UPDATE SQL statement.Be careful not to change the schema (add/drop columns) unless you know the app expects it.
If the app stores user‑generated images or audio under files/, simply replace the file with another of the same name and format. Preserve the exact filename and extension; otherwise the app may fail to locate it.
shared_prefs_original.xml) so you can revert if the app crashes..tar archiveAfter you finish editing, recreate the tar archive preserving the original directory structure.
tar -cf notes_modified.tar -C notes_backup .
The trailing dot (.) tells tar to archive everything inside notes_backup.
.tar back to an .ab backupIf you used a password for the original backup, you’ll need to re‑encrypt the tar file. The steps are the reverse of section 4.
ANDROID BACKUP followed by version and flag bytes. An easier method is to let OpenSSL create the final .ab for you:openssl aes-256-cbc -e -in notes_modified.tar -out notes_modified.ab -pass pass:YOUR_PASSWORD
cat (Linux/macOS):printf "ANDROID BACKUP\n1\n0\n" | cat - notes_modified.tar > notes_modified.ab
Now notes_modified.ab is ready for restoration.
Run the restore command:
adb restore notes_modified.ab
The phone will display a “Restore data” screen. If you set a password during encryption, enter the same password.
Wait for the process to finish – you’ll see a confirmation toast once the restore completes.
After the device reboots (some apps request a restart), launch the app. The changes you made should be visible: the new username, updated database rows, or swapped media file.
.tar and extracted folders if you no longer need them, or keep them for future edits.adb pull/push with run-asSome debug builds expose the run-as command, allowing you to pull files from an app’s private directory without creating a full backup. This method is faster but works only if the app is debuggable.
# Switch to the app’s UID
adb shell "run-as com.example.notes ls /data/data/com.example.notes/files"
# Pull a file
adb pull /data/data/com.example.notes/files/config.xml .
# Edit locally, then push back
adb push config.xml /data/data/com.example.notes/files/config.xml
# Ensure correct permissions
adb shell "run-as com.example.notes chmod 600 /data/data/com.example.notes/files/config.xml"
If run-as returns “run-as: Package ‘com.example.notes’ is not debuggable”, you’ll need to fall back to the full backup method described above.
Re‑connect the USB cable, unlock the phone, and confirm the debugging dialog. On some devices you must also enable “USB debugging (Security settings)” under Developer options.
Make sure you typed the exact password used during backup. Passwords are case‑sensitive and spaces count. If you forgot it, the only safe option is to create a new backup without a password.
logcat for stack traces:
adb logcat -d | grep com.example.notes
This indicates a wrong password or a corrupted .ab file. Verify the password and, if possible, re‑create the backup.
device_protected may not be included in a regular backup. Use adb backup -all if you need those files, but be aware they are often system‑level.adb pull /sdcard/Android/data/com.example.notes/)..ab file before you start editing. Restoring from a corrupted backup can leave the app in a broken state.This method shines in three typical scenarios:
For bulk migrations or regular backups, consider using adb backup without editing, or a dedicated backup app that handles encryption automatically.
By following the steps above you can safely peek inside an Android app’s private storage, make the precise changes you need, and restore the data without ever rooting the device. The process respects Android’s security boundaries, keeps your data encrypted if you choose, and gives you a repeatable workflow for future tweaks.









