Batterystats and Battery History on Android
Android batterystats: battery history of screen, charging, top app, wakelocks and radios, from dumpsys, bugreports and batterystats.bin, with time decoding.
- Location
- /data/system/batterystats.bin, /data/system/batterystats-checkin.bin, /data/system/battery-history/ (layout varies by release)
- Proves
- When the screen was on, when the device was plugged in or unplugged, which app was on top, which apps held wakelocks, ran jobs or used GPS, Wi-Fi and mobile radio since the last reset
- Timestamps
- History entries are offsets from a reference point printed in the dump (RESET:TIME, TIME: lines with wall-clock time); checkin output uses Unix milliseconds
- Access
- Logical (no root): adb shell dumpsys batterystats. Bugreport: included. Full file system: the .bin files in /data/system, device-encrypted, so readable in BFU by a privileged extraction. Not in ADB backup.
- Retention
- Detailed history since the last full charge or statistics reset, capped by a size limit; aggregate statistics roll over with each reset
- Collection
- adb shell dumpsys batterystats --history, adb shell dumpsys batterystats --checkin, adb bugreport, Full file system extraction
Tools
Compare all toolsWhat it is
BatteryStatsService accounts for every milliampere-hour: which app kept the CPU awake, which one used GPS, how long the screen was on, when the phone was charging. To do that it keeps a battery history, a compact stream of state changes, and aggregate statistics per UID. Developers use it to find power bugs; investigators use it because it is a timeline of device state that is available without root, through dumpsys or a bugreport.
It is especially useful for the last hours or days before seizure: screen on and off, charging, the app on top, a burst of mobile data, a GPS session, a wake from sleep by an alarm.
Where it lives
| Item | Path or command | Notes |
|---|---|---|
| Live dump | adb shell dumpsys batterystats | Full text dump; --history for the history only |
| Machine-readable | adb shell dumpsys batterystats --checkin | CSV-like lines, used by Battery Historian |
| Bugreport | dumpsys batterystats section of the main text file | Also contains --checkin output |
| On disk | /data/system/batterystats.bin, batterystats-checkin.bin | Binary parcel format, version dependent |
| History files | /data/system/battery-history/ | Numbered history chunks on releases that split history to disk |
The on-disk format is an internal parcel that changes between releases; in practice the dump is the source investigators use.
What it proves
- Screen state changes (
+screen,-screen) and screen brightness levels. - Plugged and unplugged (
+plugged,-plugged), charging status and battery level over time. - The foreground app (
+top=u0a123:"com.example.app",-top=...), a second source for app usage next to usagestats. - Wakelocks, jobs and syncs held by specific UIDs (
+wake_lock=,+job=,+sync=). - GPS on and off (
+gps), Wi-Fi scans and connections (+wifi_running,+wifi_scan), mobile radio activity, phone calls (+phone_in_call), Bluetooth. - Alarms that woke the device (
+wake_reason) and reboots (RESET,START).
It does not name locations, contacts or content. It proves device and app state, not user intent.
Key fields
| Token in history | Meaning |
|---|---|
RESET:TIME: 2026-09-14-06-02-11 | History reset and its wall-clock time |
TIME: 2026-09-14-17-40-00 | Wall-clock anchor (also after clock changes) |
+screen / -screen | Screen on / off |
+plugged / -plugged | Charger connected / removed |
+top=u0a123:"pkg" | App moved to the top (foreground) |
+running, +wake_lock= | CPU awake, wakelock held by a UID |
+gps, +wifi_scan, +mobile_radio | Radio and sensor activity |
+job=u0a88:"pkg/.Service" | Job started for an app |
UIDs like u0a123 map to packages through packages.list (u0a123 is UID 10123 for user 0).
Timestamps
Each history line starts with an offset like +2h13m05s120ms relative to the reset point. The dump prints a wall-clock anchor at the start (RESET:TIME:) and again whenever the clock changes (TIME:), in the device's local time zone. Add the offset to the most recent anchor, then convert to UTC using the device's time zone (persist.sys.timezone).
adb shell dumpsys batterystats --history > batterystats_history.txt
grep -nE 'RESET:TIME|TIME:|\+top=|\+screen|-screen|\+plugged|-plugged' batterystats_history.txt | head -40
The --checkin output (lines starting 9,0,l, and 9,h,) carries a Unix millisecond start time that Battery Historian uses to plot absolute times.
Retention
History restarts when the device is fully charged and unplugged, or when statistics are reset, and is capped by a buffer size: on a phone charged every night it often covers less than a day. Aggregate per-app statistics cover the same period. A reboot does not necessarily reset it; dumpsys batterystats --reset does, so never run it on evidence.
Collection
- Logical:
adb shell dumpsys batterystats > batterystats.txtand--checkin > batterystats_checkin.txtas early as possible, before the device charges to full. - Bugreport:
adb bugreportincludes both. - Full file system extraction: copy the
.binfiles andbattery-history/as well, even if you cannot decode them today.
Parsing
- Battery Historian renders a bugreport as an interactive timeline of all these states.
- ALEAPP and commercial suites parse the battery section of bugreports on some versions.
grepover the text dump is often enough to anchor the few events you need.
Investigator tips
- Use
+toptransitions to corroborate usagestats and Digital Wellbeing when those are missing or short. +pluggedevents next to screen activity can show the phone was being used at a desk or in a car, together with Bluetooth pairings.- A spyware-like package with constant wakelocks, jobs and mobile data but never
+topfits a background implant. - Read the bugreport and dumpsys guide for where this section sits and how to capture it cleanly.