Where the SQLite database is stored on Android

Mobile application developers are often faced with the need to debug or directly analyze the data generated application during the work process. In the ecosystem, the de facto standard for local storage of structured information is the engine. Understanding the physical location of these files is critical for conducting in-depth testing, recovering lost data, or migrating information between devices. Android the de facto standard for local storage of structured information is the engine SQLite. Understanding the physical location of these files is critical for conducting in-depth testing, recovering lost data, or migrating information between devices.

By default, the security system Android strictly isolates the space of each installed software. This means that the database files are not located in shared memory accessible to the user through the file manager. They are hidden in a protected system directory, access to which is possible only with special privileges or the use of debugging tools.

In this article, we will analyze in detail the data storage architecture, the exact paths to the files .db and .db-journal, and also consider legal and technical ways to gain access to these resources for development purposes and administration.

Standard path to database files

Each application in the system Android works under its own unique user identifier (UID). In accordance with this security model, all data created by the app is stored in a special directory, to which only the application itself and the superuser have access. Databases root. Databases SQLite are no exception to this rule.

The absolute path to the storage looks like this: /data/data/<package_name>/databases/. Here <package_name> is replaced with your application's unique package identifier, for example com.example.myapp. It is in this folder that files with the extension .dbare physically located, as well as transaction log files if the database is in active recording mode.

It is worth noting that the directory structure may differ slightly on some custom firmware or in emulators, where the root data directory may be mounted differently. However, the isolation logic by package name remains unchanged in all versions of the operating system, starting with the earliest releases.

⚠️ Attention: Direct access to the directory /data/data/ through standard file managers on a regular smartphone without superuser rights is impossible. The system will return an access error even when trying to view the list of files.

For developers using Android Studio, there is a simplified navigation method. In the tool Device File Explorer this directory is displayed automatically when a debugging device is connected. You can expand the directory tree, find the folder databases and download the desired file to your computer for analysis in a third-party editor, such as DB Browser for SQLite.

Access via ADB without root access

Many developers mistakenly believe that a rooted device is required to extract the database. In fact, there is a legal access mechanism through the debug bridge ADB (Android Debug Bridge), which works on most custom firmwares when USB debugging is enabled.

The essence of the method is to use the command run-as. This utility allows you to execute a command in the context of a specific application, temporarily elevating the process's privileges to that application's UID. This way, you can read files from a protected directory without having full superuser rights on the entire device.

The process is as follows. First you need to connect to the device shell, then switch to the context of the desired package and copy the database file to a temporary public folder, for example /sdcard/. From there, the file can be freely downloaded to your computer.

adb shell
run-as com.example.myapp
cp /data/data/com.example.myapp/databases/mydb.db /sdcard/
exit
adb pull /sdcard/mydb.db

It is important to understand the limitations of this method. The command run-as will only work if the application is built in the debuggablemode. For release versions of applications signed with production keys and distributed through stores, this access method will be blocked by the security system.

Obtaining root access

Having superuser rights (root) removes almost all restrictions on access to the file system Android. This is the most powerful method that allows you not only to read, but also to modify the databases of any applications, including system services Google Play Services or instant messengers.

To work with files in this mode, advanced file managers are usually used, such as Root Explorer, Solid Explorer or terminal emulators with the command su. After granting access rights, you get full control over the directory /data/data/.

• 🔓 You can copy database files from any application without the restrictions of debug mode.
• ✏️ Direct editing of the contents of .db files on the fly is available through built-in SQL editors.
• ⚙️ It is possible to replace a damaged database with a backup copy manually.

However, using root access carries serious risks. Incorrect modification of system databases can lead to unstable operation of the operating system, endless reboots (bootloop) or complete loss of data. In addition, many highly secure banking applications and services refuse to run on compromised devices.

⚠️ Attention: Before any editing of the database with root access, be sure to create a full backup of the original file. An error in an SQL query can irreversibly damage the table structure.

Why don't banking applications work on Root?

Financial application developers implement runtime integrity checks (SafetyNet / Play Integrity API). Detection of superuser rights or an unlocked bootloader is considered a security risk, and access to the application is blocked.

Storage features in Android 10 and higher

Starting with version Android 10 (API level 29), Google has implemented a stricter storage access policy, known how Scoped Storage. This initiative was aimed at protecting user privacy and limiting applications' access to files of other apps.

Although the physical path to databases /data/data/<package_name>/databases/ remained the same, the mechanisms for accessing it became stricter. Even with ADB rights, access to some system processes may be limited. Moreover, File-Based Encryption (FBE) has become a standard.

This means that database files are encrypted with a key that is only accessible after the user unlocks the device. If the device is rebooted and in the "until first unlocked" (DFU) state, data access via a physical connection or ADB will not be possible, even with root access, since the decryption keys have not yet been loaded into memory.

Android version	Access via ADB	Encryption data	Scope Storage limitations
Android 9 and below	Full (for debug apps)	Optional	Absent
Android 10	Limited	Required (FBE)	Implemented
Android 11+	Strictly limited	Reinforced	Full isolation
Android 13+	Requires explicit permission	Hardware	Extended to media

Developers need to take these changes into account when designing backup tools. Reliance on direct access to the file system is becoming an increasingly less reliable method, and it is recommended to use official APIs for exporting data.

Analyzing the structure of database files

B folder databases you will rarely find only one file. The engine SQLite creates several support files to ensure transaction integrity and performance. Understanding their purpose helps to avoid errors when copying or restoring data.

The main file has the name specified when creating a connection to the database, and an extension .db (or without an extension, depending on the implementation). However, next to it there are often files with suffixes -journal, -wal and -shm. Ignoring these files when copying can result in the database being in an inconsistent state or recent transactions being lost.

• 📄 main.db: The main file containing tables, indexes and data.
• 📝 main.db-journal: The rollback journal file, used in DELETE mode. Contains the original page data before modification.
• ⚡ main.db-wal: Write-Ahead Log. Used in WAL mode to improve write performance. Contains the latest uncommitted changes.

Particular attention should be paid to WAL mode. In modern versions Android it is used by default for many system components. If you copy only the main file .dbwhile leaving the file .wal on the device, you will lose all data written since the last checkpoint.

⚠️ Attention: When backing up a database in WAL mode, you must copy all three files (.db, .db-wal, .db-shm) at the same time. The absence of any of them will make the database unreadable or incomplete.

For correct data transfer, it is recommended to either force the command CHECKPOINT before copying to reset the WAL contents to the main file, or ensure an atomic copy of all related files.

Alternative methods for exporting data

Direct copying of files is not the only and not always the safest way to work with data. For tasks that do not require deep intervention in system files, there are more civilized export methods provided by the platform itself Android.

Starting with Android 12, users received a built-in function for creating backup copies of specific application data through the system settings. This method allows you to upload data in encrypted form to Google Drive or local storage, although direct access to the file is more difficult to obtain in this case. Developers can also implement their own export mechanism within the application. For example, the Export Data button can generate a CSV or JSON file in a public folder .db in this case it is more difficult to obtain.

Developers can also implement their own export mechanism within the application. For example, the Export Data button can generate a CSV or JSON file in a public folder Download. This completely bypasses the need for ADB or root access and is the only legal way for regular users to get their data from closed applications.

If your goal is simply to view the contents of tables and not modify them, using monitoring tools in Android Studio (App Inspection) is the preferred option. This tool connects to a running process and displays real-time data through a secure debug channel.

Is it possible to open a SQLite database without a computer?

Yes, it is possible. There are mobile database viewer applications (for example, SQLite Editor) that can open files .db right on your smartphone. However, such applications will require root access to access system databases.

What if the database file is 0 bytes?

A file of 0 bytes usually means that the database has been created, but no data has yet been written to it, or a critical error occurred during initialization. Check the application logs (logcat) for SQL errors.

Is it safe to edit the messenger database?

No, it is extremely unsafe. Messengers often use hashes and checksums to verify the integrity of local data. Any third-party intervention may result in the application deeming the database damaged and deleting it or blocking the account.

Where are system application databases stored?

System applications (for example, Phone, Contacts) also store data in /data/data/, but their packages are signed by the system. They can only be accessed through root or in an emulator with developer rights.

How to find the name of the application package for the path to the database?

The package name can be found in the Android settings in the "Applications" section, or using the ADB command: adb shell pm list packages | grep "part of name". There are also package inspector applications in the Play Market.