Backups create additional copies of sensitive data and allow it to reappear on another device. An Android protection plan must also cover identity and key state after restoration.
Evaluation approach
Explicitly define included and excluded data. Device-bound keys and portable application data have different lifecycles.
Application example
Test what restored session data does on a new phone when the old device's key is unavailable.
Limits and considerations
Local encryption does not make backup policy unnecessary. Key loss needs a secure recovery path.
Copies outside the application
Review backup and device-migration behavior alongside local storage. A file in an application directory does not necessarily remain there throughout its lifecycle. Exports and diagnostic sharing can create further copies.
Restored sessions or device registrations must remain consistent with server assumptions after migration. Trust assigned to the old device must not silently transfer to the new one. Check backup configuration against both source files and actual distribution behavior.
Checks and decisions
- Classify sensitive data
- Test restoration
- Require reauthentication
Test the authority under which an old session continues on a new device.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.