External Storage Exposure
How External Storage Exposure works
Saving sensitive files to external/shared storage (e.g., /sdcard) exposes them to other apps and to users connecting the device over USB. External storage lacks per‑app isolation.
External Storage Exposure in practice
Pull Data From External Storage
adb shell ls -l /sdcard/Android/data/com.example.app/files
adb pull /sdcard/Android/data/com.example.app/files/backup.json .If files contain tokens/PII, they are exposed beyond the app sandbox.
How to fix and prevent External Storage Exposure
- Prefer internal storage
- Use app‑private directories; avoid external storage for sensitive content.
- Encrypt at rest
- If external storage is required, encrypt files with keys from Keystore and include integrity checks.
- Lifecycle hygiene
- Wipe temporary/cache files and revoke access promptly.
Last updated
