Page 1
ANDROIDUSAGE & SYSTEMARTEFACTS · A GUIDE FOR UK LAWYERS Android Usage, Activity and System Artefacts Usage Stats, Digital Wellbeing, Notifications and Logs: The Phone's Own Record of What Was Done, and When COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DEVICE-ACTIVIT Y RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone keeps a diary here too 03 What Android's usage and system artefacts record 04 Reconstructing the device-activity timeline 05 Manufacturer variation and expert interpretation 06 Rotation, corroboration and honest limits 07 Deployment: proving what the device was doing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary databases and logs of screen, lock, battery, connection and installation events, which together reconstruct whether the phone was in use, which app was open and how activity flowed, but vary by manufacturer, demand expert interpretation, and age out.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone keeps a diary here too
§ 03 · WHATTHEYRECORD What Android's usage and system artefacts record USAGE STATS WELL BEING NOTIFICATIONS SCREEN / LOCK / TIMELINE POWER
Page 2
§ 04 · THEACTIVITYTIMELINE Reconstructing the device-activity timeline
§ 05 · VARIATIONANDINTERPRETATION Manufacturer variation and expert interpretation
§ 06 · ROTATIONANDHONESTLIMITS Rotation, corroboration and honest limits
§ 07 · DEPLOYMENT Deployment: proving what the device was doing
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ACCOUNT (GOOGLE / PHONE LIVE DEVICE PAIRED AGED-OUT / ARTEFACTS WEARABLE RECOVERABLE GOOGLE BACKUP S OTHER ACTIVIT Y MAKER) DATA
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDIARYTHATSHOWEDTHEPHONEUNLOCKEDANDINUSE EXAMPLE2 · THESAMEARTEFACTINADIFFERENTPLACE EXAMPLE3 · THEGAPTHATWASROTATION, ANDTHEACCOUNTTHATFILLEDIT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROID AC TIVITYANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android activity checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What activity records does an Android phone keep? What can these artefacts show? Are these records the same on every Android phone? If there are no usage records for a period, does that prove nothing happened? How reliable is this evidence? Does the Google account help with activity?
§ 14 · REFERENCE Glossary Sources and authoritative references 35 and CrimPR Part 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Usage Activity And System Artefacts, Computer Forensics Lab, https://e-discovery.uk/library/android-usage-activity-and-system-artefacts/pdf.