How to Inspect Face Authentication States and Biometric Enrollment on Android Using ADB dumpsys face

Modern Android devices incorporate biometric authentication systems governed by the Android Biometric Framework. While fingerprint verification is managed by fingerprint HAL services, facial authentication is routed through dedicated Camera HAL and Biometrics Face HAL interfaces managed by FaceService. For system engineers, mobile security analysts, and platform developers, evaluating facial biometric state transitions, enrollment metadata, sensor capabilities, and authentication latency requires low-level inspection. On Android devices with developer debugging enabled, this inspection is conducted via Android Debug Bridge (ADB) using the dumpsys face diagnostic command.

Architecture of the Android Face Authentication Service

In Android 10 and subsequent releases, biometric authentication conforms to standardized BiometricPrompt APIs. The system service face (implemented in com.android.server.biometrics.sensors.face.FaceService) coordinates communication between high-level security managers and hardware-specific Hardware Abstraction Layer (HAL) implementations:

• HIDL/AIDL Face HAL: Directly interfaces with secure hardware (Trusted Execution Environment or Secure Enclave) performing infrared or camera-based face capture and template matching.
• Enrollment Store: Maintains cryptographic template identifiers mapped to distinct Android User IDs (e.g., User 0 for primary profile, User 10 for work profiles).
• Sensor Properties: Reports sensor modality (RGB single camera vs structured light 3D infrared) and Biometric Security Level (Class 3 / Strong, Class 2 / Weak, or Class 1 / Convenience).

Querying Face Sensor Properties and State via ADB

Connect the Android device over USB or Wi-Fi debugging and ensure device authorisation is granted via adb devices. To dump the complete state of the facial authentication subsystem, execute:

adb shell dumpsys face

The command outputs diagnostic sections detailing sensor identifiers, active user enrollment tables, HAL daemon process status, and historical authentication events.

Analysing Key Diagnostic Output Sections

1. Sensor Configurations and Modality

The top section of the output reveals the physical and logical sensor parameters configured by the device OEM:

Sensor Properties:
  Sensor ID: 1
  Modality: FACE
  Strength: BIOMETRIC_STRONG (Class 3)
  Component Info:
    Vendor: OEM_SECURE_BIO
    Hardware Version: 2.1
    Firmware Version: 1.0.45
  Supports Face Detect: true
  Supports Confirmation: true

The strength field (BIOMETRIC_STRONG vs BIOMETRIC_WEAK) determines whether the facial authentication can unlock Keystore cryptographic keys and authorize banking or payment transactions, or if it is restricted to basic lockscreen dismissal.

2. Active User Enrollment Records

dumpsys face displays enrollment tables associated with each user profile on the device:

User 0:
  Enrolled Faces: 1
    Face ID: 1, Name: Face 1, Group: 0, Device ID: 1
  Authenticator ID: 104857692134598124
User 10 (Work Profile):
  Enrolled Faces: 0

Notice the Authenticator ID. This 64-bit integer changes whenever a face is added or re-enrolled. Cryptographic Keystore keys bound with setUserAuthenticationRequired(true) incorporate this Authenticator ID to detect biometric database modifications and prevent key reuse across unauthorized enrollments.

3. Client Monitor Queue and Scheduler

The biometric scheduler handles asynchronous tasks such as enrollment, authentication, removal, and enumeration. Reviewing the scheduler status helps diagnose hung authentication attempts or background lockouts:

Scheduler:
  Current Operation: null
  Pending Operations: 0
  History (last 20 operations):
    Op: FaceAuthenticateClient, User: 0, Success: true, Duration: 245ms
    Op: FaceDetectClient, User: 0, Success: true, Duration: 120ms
    Op: FaceAuthenticateClient, User: 0, Success: false (Error: TIMEOUT), Duration: 3000ms

Filtering Specific Face Subsystem Metrics

To isolate enrollment IDs or check whether any facial templates are currently registered without parsing extensive logs, use standard shell filters:

# Check enrolled face counts across all profiles
adb shell dumpsys face | grep -E "User|Enrolled Faces"

# Verify HAL daemon connectivity
adb shell dumpsys face | grep -i "hal"

# Check sensor strength classification
adb shell dumpsys face | grep -i "strength"

Resetting Subsystem State for Quality Assurance

During mobile application QA or biometric regression testing, engineers often simulate biometric lockouts or test app behaviour when biometric profiles are deleted. While ADB shell commands cannot bypass hardware-enforced cryptographic boundaries, administrative commands allow clearing app-specific lockout states:

# Reset biometric lockout state for primary user
adb shell cmd face reset-lockout 0

Leveraging dumpsys face equips technical teams with granular visibility into Android facial recognition subsystems, providing unambiguous metrics to diagnose hardware state, verify security classification, and troubleshoot authentication lifecycle failures.