What is the BACKUP1 file format?
A .backup1 file is the second part of a split backup made by an Android device's stock System Recovery Mode, seen most often on older Samsung phones and tablets. When the device backs up its userdata partition, the SD card holding the copy is usually formatted FAT32, which cannot store a file larger than about 2GB. The recovery works around this by writing the image in 2GB slices: the first is named .backup, the next .backup1, then .backup2, and so on. Each file carries a timestamp, for example userdata_20240101_000617.backup1.
On its own a .backup1 part is incomplete. Together the parts form one image of the userdata partition, holding contacts, app data, media, and settings. Every 2GB slice begins with a 512-byte header block that is not part of the payload. Once the headers are stripped and the parts are joined in order, the result is usually a raw ext4 filesystem, though some devices store a gzip-compressed tar stream instead. Despite the similar name, this is not the .ab format produced by adb backup.
Security & safety
RISK: LOWA .backup1 part is inert data, not executable, so it cannot run on its own. The main practical risk is data loss during reassembly: extract with read-only mounts and work on copies, since a missing or out-of-order part yields a corrupt ext4 image. The backup is unencrypted, so treat it as sensitive personal data because it can contain contacts, messages, and app credentials.
Format details
in a nutshell- Generic incremental backup part - Some backup utilities append .backup1, .backup2 as generation or rotation numbers to any file's backup copy, unrelated to Android.
- Editor/app numbered backup copy - A few programs write .backup1 as a second-newest safety copy alongside .backup when saving a document or config.
Programs that open BACKUP1 files
Windows2 apps
7-Zip
Open-source For the gzip-tar variant, once the 512-byte header is removed, 7-Zip can open the resulting gzip and tar layers to extract the archived files. 
DiskInternals Linux Reader
Freemium After you concatenate the header-stripped parts into a single ext4 image, open that image in Linux Reader to browse and export files from the ext4 filesystem on Windows. 
Linux3 apps
dd + mount (coreutils / util-linux)
Open-source Strip the 512-byte header from each part with dd (skip=512), append the parts in order into one img.ext4, then mount it read-only as ext4 with mount -t ext4 -o loop,ro to browse the userdata contents.
gunzip + tar (GNU tar)
Open-source For the gzip-tar variant, pipe the header-stripped stream through gunzip and tar (dd if=userdata_....backup skip=1 bs=512 | gunzip -c | tar xv) to unpack files directly without mounting.
e2fsprogs (debugfs / dumpe2fs)
Open-source After reassembling the ext4 image, use debugfs to inspect and extract individual files or run fsck.ext4 to repair a damaged image before mounting. Technical details
deep spec| Encoding | Binary. Raw ext4 filesystem bytes, or a gzip-compressed tar stream, depending on the device recovery implementation. |
| Byte order | Little-endian (ext4 on ARM Android devices) |
| Container | Split segment: one slice of a larger logical image spread across .backup, .backup1, .backup2 and so on. |
| Compression | None for the raw-ext4 variant; gzip (DEFLATE) for the tar-based variant seen on some devices. |
| Encryption | None by default. The stock recovery backup is unencrypted, which is what makes offline extraction with dd/mount possible. |
| Typical size | About 2 GB per part; the recovery splits at the ~2GB boundary imposed by FAT32 SD cards. |
| Structure | Each part begins with a 512-byte header block that must be stripped, then holds a 2GB slice of the payload. Parts are numbered .backup (first), .backup1 (second), .backup2 (third) and continue sequentially. Concatenating the header-stripped payloads reconstructs a single ext4 image (or a single gzip+tar stream). |
| Integrity | No standard embedded checksum documented; integrity depends on all parts being present and concatenated in order. |
| Platforms | Android |
| Notes | Files carry a timestamped name such as userdata_yyyymmdd_HHMMSS.backup1 and are written to the device SD card by System Recovery Mode. This is distinct from the adb backup .ab (Android Backup) format. Reassembly command pattern: dd if=userdata_....backup1 skip=512 bs=128k iflag=skip_bytes oflag=append conv=notrunc of=img.ext4 (repeated per part), then mount -t ext4 -o loop img.ext4 /mnt. |
| Structure Type | Split multi-part image |
| Released | Early 2010s (Android device recovery backups) |
BACKUP1 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about BACKUP1 files.
Frequently asked questions
Can I open a .backup1 file by itself?
.backup1 file is only the second slice of a larger image. You need the matching .backup first part and any further .backup2, .backup3 parts, all from the same backup, before you can reassemble and read anything.How do I restore a .backup1 backup to my phone?
Why is my backup split into .backup, .backup1 and .backup2 files?
How do I extract the data on a Windows PC?
Is a .backup1 file encrypted?
Is this the same as an adb backup .ab file?
.ab Android Backup format comes from the adb backup command and stores per-app data. A .backup1 part is a slice of a raw userdata partition image made by device recovery. They are not interchangeable.
