# How to Record Calls on Android Without Root: Installing AVault, Encryption and Moving Recordings

> AI Release · @ai_release1 · https://ai-release.org/guides/kak-zapisyvat-zvonki-na-android-bez-root-ustanovka-avau_en.html

## TL;DR

- **Time to complete:** about 30 minutes (10 minutes to install and tune the app, 10 to record and encrypt, 10 to verify and move the files).
- **Difficulty:** Intermediate — you need a USB cable, a terminal, and you must understand where your recording files actually live.
- **You will need:** an Android phone with AVault installed, a USB data cable, Android Platform Tools (`adb`) on your computer, `tar` and OpenSSL 3.x on the computer, and free disk space equal to at least twice the size of your recordings.

AVault is a call-recording app; the exact package name, default output folder, and encryption options depend on the build you install — where this guide cannot see your screen, it says **check the app's documentation** and gives you a command that reveals the real value.

## Requirements and setup
![Illustration: Requirements and setup](https://ai-release.org/guides/img/kak-zapisyvat-zvonki-na-android-bez-root-ustanovka-avau-en-1.jpg?v=1793955148)


- **Android phone** with AVault installed from a source you trust. If you sideload an APK, allow it first: *Settings → Apps → Special app access → Install unknown apps → \<your browser/file manager\> → Allow from this source*.
- **USB data cable.** Charge-only cables produce the classic "device not found" loop.
- **Android Platform Tools** on the computer (`adb`). Verify:

```bash
adb version
```

Expected output starts with `Android Debug Bridge version` — any recent 1.0.4x build is fine.

- **OpenSSL 3.x** for encryption:

```bash
openssl version
```

Expected: a line starting with `OpenSSL 3.` — 3.x supports `-pbkdf2 -iter`, which the commands below use.

- **Free space:** at least 2× the size of your recording archive (one copy for the `.tar.gz`, one for the `.enc` file).
- **Copy of your passphrase** in a password manager. Symmetric encryption (one key for lock and unlock) has no recovery path — lose the passphrase and the archive is gone.

Pre-flight checklist:

- [ ] `adb devices` lists your phone as `device`, not `unauthorized`
- [ ] AVault has Microphone and Phone permissions granted
- [ ] Battery optimisation is off for AVault
- [ ] You know the app's output folder (see Step 1)

## Step 1. Install AVault and give it the permissions a recorder needs

**What to do:** Install or open AVault, then grant the permissions it asks for: **Microphone** (the actual audio), **Phone** (to detect when a call starts and stops), **Notifications** (a foreground service keeps the recorder alive), and **Files/Storage** if the app writes to a shared folder. Then remove battery restrictions: *Settings → Apps → AVault → Battery → Unrestricted*. On Xiaomi, Huawei, Oppo and Vivo also enable *Autostart* for the app — the guide [How to Disable Ads, Recommendations and Push Notifications on Chinese Android Phones Without Root](https://ai-release.org/guides/kak-otklyuchit-reklamu-rekomendatsii-i-novostnye-podska.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide) shows where those vendor menus hide. Finally, open AVault's settings and note the **output folder** it shows — for example `/sdcard/Recordings` or an app-private path under `/sdcard/Android/data/<avault.package>/files/`. Write it down.

**Why:** Android kills background services aggressively. A recorder that loses its foreground service stops mid-call and you get a truncated file — the most common "the app doesn't work" report. The output folder matters because Android's scoped storage means the app may not write where you expect.

**How to check:** Connect the phone, accept the "Allow USB debugging" dialog, then:

```bash
adb devices
adb shell pm list packages | grep -i vault
adb shell appops get <avault.package> RECORD_AUDIO
```

Expected: `adb devices` shows `<serial>	device`; `pm list packages` returns one line such as `package:com.example.vault` — that is your `<avault.package>`; `appops get` returns `RECORD_AUDIO: allow`. If it returns `deny`, grant Microphone in *Settings → Apps → AVault → Permissions* and re-run.

**Example:** on a test phone the package line came back as `package:com.example.vault`, so every later command used `com.example.vault` in place of `<avault.package>`.

## Step 2. Record a test call and encrypt the archive
![Illustration: Step 2. Record a test call and encrypt the archive](https://ai-release.org/guides/img/kak-zapisyvat-zvonki-na-android-bez-root-ustanovka-avau-en-2.jpg?v=1793955158)


**What to do:** Make a 30–60 second real call with AVault running, then copy the file to the computer and encrypt the whole folder with a passphrase.

```bash
mkdir -p ~/avault && cd ~/avault
adb shell find /sdcard -type f \( -iname "*.m4a" -o -iname "*.wav" -o -iname "*.opus" -o -iname "*.amr" \) 2>/dev/null | head -n 20
adb pull "<path printed above, e.g. /sdcard/Recordings>" ./recordings
ls -lh ./recordings
```

Now pack and encrypt — run this on the computer (or inside Termux on the phone, see [How to Run Linux on Android Without Root: Termux, PRoot, and AI Tools](https://ai-release.org/guides/kak-zapustit-linux-na-android-bez-root-termux-proot-i-i.html?utm_source=tg&utm_medium=channel&utm_campaign=guide_inline&utm_content=guide_to_guide)):

```bash
tar -czf avault-$(date +%F).tar.gz -C ./recordings .
openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -salt \
  -in avault-$(date +%F).tar.gz \
  -out avault-$(date +%F).tar.gz.enc \
  -pass pass:'<your-long-passphrase>'
ls -lh avault-$(date +%F).tar.gz*
```

**Why:** `tar` bundles many small files into one stream you can checksum and copy atomically; `-pbkdf2 -iter 200000` makes brute-forcing the passphrase 200,000 times more expensive per guess than a single hash; `-salt` stops precomputed rainbow tables. `-aes-256-cbc` is a standard, widely supported cipher, so you can decrypt on any machine later without AVault.

**How to check:** Prove the archive decrypts and that it contains what you think it does:

```bash
openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 \
  -in avault-$(date +%F).tar.gz.enc \
  -pass pass:'<your-long-passphrase>' | tar -tzf - | head
```

Expected: a list of file names, e.g. `./call-2025-01-01-10-32.m4a`. If you see `tar: This does not look like a tar archive`, the passphrase or `-iter` value is wrong.

**Example:** a 47-second test call produced a 1.1 MB `.m4a`; the encrypted archive `avault-2025-01-01.tar.gz.enc` sat next to the plain `.tar.gz`.

## Step 3. Verify integrity and move the archive to a second device
![Illustration: Step 3. Verify integrity and move the archive to a second device](https://ai-release.org/guides/img/kak-zapisyvat-zvonki-na-android-bez-root-ustanovka-avau-en-3.jpg?v=1793955165)


**What to do:** Compare the file hash on the phone with the hash on the computer, then copy the encrypted archive to your NAS, external drive or cloud folder and delete the plaintext copy from the phone and the computer.

```bash
adb shell sha256sum "/sdcard/Recordings/<file>.m4a"
sha256sum ./recordings/<file>.m4a
cp avault-$(date +%F).tar.gz.enc /media/<your-backup-drive>/avault/
sha256sum /media/<your-backup-drive>/avault/avault-$(date +%F).tar.gz.enc
rm avault-$(date +%F).tar.gz
adb shell rm "/sdcard/Recordings/<file>.m4a"
```

**Why:** A checksum (a fixed-length fingerprint of the file) turns "the copy looks fine" into a yes/no answer — one changed byte changes the entire hash. Deleting the plaintext after encryption means the only copy left is the one protected by your passphrase.

**How to check:** The three hashes must be identical for the archive copies, and you should be able to decrypt straight from the backup drive:

```bash
openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 \
  -in /media/<your-backup-drive>/avault/avault-$(date +%F).tar.gz.enc \
  -pass pass:'<your-long-passphrase>' | tar -tzf - | wc -l
```

Expected: `adb shell sha256sum` and `sha256sum` print the same 64-character hex string, and the last command prints a file count (e.g. `12`), not an error. Success looks like: no plaintext `.m4a` on the phone, one `.tar.gz.enc` on the backup drive, and a listing you can reproduce from that drive alone.

## Troubleshooting

**Problem. `adb devices` shows the phone but nothing works.**

- Error: `adb: device unauthorized. Please check the confirmation dialog on your device.`
- Cause: the RSA key fingerprint prompt was dismissed or never accepted, so the computer is not trusted.
- Fix: unplug and replug the cable, unlock the phone, tap **Allow** on the "Allow USB debugging?" dialog (tick "Always allow from this computer"), then `adb kill-server && adb start-server && adb devices` — the state must change from `unauthorized` to `device`.

**Problem. The pull command cannot find the recordings.**

- Error: `adb: error: failed to stat remote object '/sdcard/Recordings/': No such file or directory`
- Cause: the app writes to a different folder (often an app-private one under `/sdcard/Android/data/<avault.package>/files/`), or the recording was never created because the foreground service was killed.
- Fix: list real audio files first — `adb shell find /sdcard -type f -iname "*.m4a" 2>/dev/null | head -n 20` — and pull that exact path. If nothing is listed, open AVault, record a new test call with the screen unlocked, and re-run the search. Confirm the default folder in the app's settings; if the field is empty, **check the app's documentation**.

**Problem. Decryption fails on the backup drive.**

- Error: `bad decrypt` followed by `error:1C800064:Provider routines::bad decrypt`
- Cause: wrong passphrase, or the `-iter` value differs from the one used at encryption time (OpenSSL derives a different key), or the file was truncated by an interrupted copy.
- Fix: re-enter the passphrase from your password manager with `-iter 200000`, and compare `sha256sum` of the backup copy against the original. If the hashes differ, copy the file again and re-check — a truncated `.enc` can never be decrypted.

## Summary and next steps

You now have a repeatable loop: record with AVault, pull the files over `adb`, pack and encrypt them with `openssl`, and verify with SHA-256 before deleting the plaintext. The next step is to automate it — a weekly `adb pull` plus `tar`/`openssl` script in `cron`, pointed at your backup drive.

## FAQ

**Does call recording on Android require root?**
No — AVault and similar apps run as normal apps with the Microphone and Phone permissions. What varies by device is whether Android lets a third-party app capture the other party's audio; if your recordings contain only your own voice, that is the OS restriction, not a root problem.

**Where does AVault save recordings?**
In the output folder shown in the app's settings, commonly `/sdcard/Recordings` or an app-private path under `/sdcard/Android/data/<avault.package>/files/`. Run `adb shell find /sdcard -type f -iname "*.m4a"` to see the real path; for the default value, check the app's documentation.

**Can I decrypt the archive without AVault installed?**
Yes. The archive is a standard `tar.gz` encrypted with `openssl enc -aes-256-cbc`, so any machine with OpenSSL 3.x and the passphrase can unlock it — the app is not needed for playback or recovery.

**Why does the recorder stop when the screen is off?**
Battery optimisation or a vendor autostart manager killed the foreground service. Set *Settings → Apps → AVault → Battery → Unrestricted*, enable autostart on Xiaomi/Huawei/Oppo/Vivo, and re-test with a 60-second call.