Page 1

ANDROIDUSAGE & SYSTEMARTEFACTS · A GUIDE FOR UK LAWYERS Android Usage, Activity and System Artefacts Usage Stats, Digital Wellbeing, Notifications and Logs: The Phone's Own Record of What Was Done, and When COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DEVICE-ACTIVIT Y RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone keeps a diary here too 03 What Android's usage and system artefacts record 04 Reconstructing the device-activity timeline 05 Manufacturer variation and expert interpretation 06 Rotation, corroboration and honest limits 07 Deployment: proving what the device was doing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary databases and logs of screen, lock, battery, connection and installation events, which together reconstruct whether the phone was in use, which app was open and how activity flowed, but vary by manufacturer, demand expert interpretation, and age out.

§ 02 · FIRST PRINCIPLES The problem in plain English: the phone keeps a diary here too

§ 03 · WHATTHEYRECORD What Android's usage and system artefacts record USAGE STATS WELL BEING NOTIFICATIONS SCREEN / LOCK / TIMELINE POWER