ZEKASTRA

AndroidAdvancedAccounts

Account manager databases (accounts_ce.db / accounts_de.db)

AccountManagerService stores: account names and types, auth tokens in CE storage, and a 64-row debug log of account actions in DE storage.

01Location

  • /data/system_ce/<userId>/accounts_ce.db
  • /data/system_de/<userId>/accounts_de.db
  • /data/system/users/<userId>/accounts.db (pre-N single database, migrated)

02Questions it answers

  • Which accounts (e.g. email, cloud, messaging) were registered on the device?
  • Were accounts added, removed or renamed recently, and by which caller UID?
  • When was a password last entered for an account?

03Format and versions

FormatSQLite databases managed by AccountsDb. CE: accounts (name, type, password), authtokens, extras. DE: accounts (_id, name, type, previous_name, last_password_entry_time_millis_epoch), grants, visibility, shared_accounts, meta and debug_table.
Applies toReleases before Android N used a single accounts.db (PRE_N_DATABASE_VERSION 9); current code migrates it into the DE/CE pair. Credential-encrypted (CE) storage is available only after the user unlocks the device.

04Key fields

FieldWhat it tells you
accounts.name / accounts.typeAccount identifier and authenticator type.
authtokens (CE)Authentication tokens per account; treat as live credentials.
debug_table.action_typeAction string, e.g. action_account_add, action_account_remove, action_account_rename, action_set_password, action_sync_de_ce_accounts.
debug_table.caller_uid / table_name / _idUID of the caller, affected table and row id.
accounts.previous_name (DE)Earlier name of a renamed account.

05Timestamps

FieldEncodingNote
last_password_entry_time_millis_epochUnix epoch, millisecondsLast time a password was entered for the account.
debug_table.timeText "yyyy-MM-dd HH:mm:ss", no time zoneWritten with a SimpleDateFormat given no zone: a device wall-clock string. Report as text and state the assumed offset.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Collect both DE and CE databases per user, plus any legacy accounts.db.
  2. List accounts from DE and CE and compare them.
  3. Order debug_table entries and map caller UIDs to packages.
  4. Interpret debug times as local wall-clock text, not UTC.
  5. Restrict and document handling of token and password columns.

07Interpretation pitfalls

  • debug_table holds at most 64 rows and reuses the oldest slot, so older actions are overwritten.
  • Debug rows can name account ids no longer in accounts; ALEAPP found 192 of 306 such rows across its test images.
  • If only DE storage is available, CE-only tables (tokens, passwords) will be missing.

09Sources

  1. AOSP — AccountsDb.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
  2. AOSP — AccountManagerService.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
  3. AOSP — Environment.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
  4. ALEAPP — scripts/artifacts/accounts_ce.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
  5. ALEAPP — scripts/artifacts/accounts_de.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
  6. Support Direct Boot mode Android Developers · checked 2026-10-14