Skip to content
AndroidForensics

User activityApp usage

Recent Tasks and Snapshots: recent_tasks, snapshots

Android recent tasks XML and task snapshot images in system_ce: what the Overview screen stored, last active times, screenshots of app screens, FLAG_SECURE.

Location
/data/system_ce/<user>/recent_tasks/ and /data/system_ce/<user>/snapshots/
Android
Proves
Which app tasks were in the Overview (recents) screen, which activity each started from, when each was last moved to the front, and an image of what each app showed when it was last left
Timestamps
Task XML: last_time_moved (and related attributes) in Unix milliseconds (UTC); snapshot images: file system modification times
Access
Full file system (root, exploit or agent); credential-encrypted storage, so AFU only. Logical and bugreport: dumpsys activity recents lists current tasks, without images. Not in ADB backup.
Retention
Until the task is removed from Overview (swiped away, cleared, app uninstalled) or the recents list overflows; persists across reboots
Collection
Full file system extraction, adb shell dumpsys activity recents, adb bugreport

Tools

Compare all tools

What it is

When you press the Overview button (or swipe up and hold), Android shows the recent tasks, each with a picture of the app as you left it. The system persists that list so it survives a reboot: one XML file per task describing the task, and one image per task, the task snapshot. The snapshot is a real screenshot of the app window taken by the window manager when the task went to the background.

For an investigator that means a screenshot of a chat, a map, a banking screen or a browser page can exist on disk even if the user never took a screenshot, and sometimes after the content was deleted in the app itself.

Where it lives

ItemPathNotes
Task records/data/system_ce/<user>/recent_tasks/<taskId>_task.xmlOne file per persisted task; ABX on Android 12 and later on most builds
Snapshots/data/system_ce/<user>/snapshots/<taskId>.jpgFull-size snapshot
Reduced snapshots/data/system_ce/<user>/snapshots/<taskId>_reduced.jpgLower resolution copy used for animations
Snapshot metadata/data/system_ce/<user>/snapshots/<taskId>.protoOrientation, insets, scale, on releases that write it
Persisted task IDs/data/system_de/<user>/persisted_taskIds.txtIDs in use, on some releases

Android 7 and earlier stored thumbnails under /data/system/recent_images/. OEM launchers (One UI, for example) display recents differently but the system files keep the AOSP layout; confirm the folder names on your build.

What it proves

  • The app tasks that were in the recents list, with the activity that started each task (real_activity) and its affinity.
  • When each task was last moved to the front (last_time_moved), a foreground time that survives even when usagestats has rolled over.
  • What the app displayed when it was last left, as an image: often the most direct evidence of content the user saw.
  • Tasks for apps that are no longer installed, if the files were not cleaned up.

It does not show every app used, only the tasks still in the list, and the snapshot shows the last state only.

Key fields

Attribute (task XML)Meaning
task_idNumeric ID, matches the snapshot file name
real_activity, orig_activityComponent that started the task
affinity, root_affinityTask affinity (usually the package name)
last_time_movedLast time the task came to the front, Unix milliseconds
calling_uid, calling_packageWho launched the task
user_id, effective_uidProfile and UID of the app
task_description_label, task_description_colorLabel and colour shown in recents

Attribute names follow AOSP TaskRecord / Task persistence and shift slightly between releases.

Timestamps

last_time_moved is Unix milliseconds in UTC. Snapshot images carry no internal timestamp, so use their modification time, which should be close to the time the task last left the foreground.

# Android 12+: convert ABX to text first
# (on a device: abx2xml in out; offline: ccl_abx, see its README)
grep -o 'last_time_moved="[0-9]*"' 1043_task.txt.xml
# 1789400592120 -> convert as Unix milliseconds
date -u -r $((1789400592120 / 1000))   # macOS; GNU: date -u -d @1789400592

Retention

A task and its snapshot are deleted when the user swipes it away, uses Clear all, or the app is uninstalled, and old tasks drop off when the list exceeds its limit. Otherwise they persist across reboots. Snapshots are overwritten each time the task goes to the background again. Apps that set FLAG_SECURE (banking apps, Signal with Screen security on, incognito tabs on some browsers) get a blank or no snapshot.

Collection

  • Full file system extraction (AFU): copy both folders; keep file timestamps.
  • Logical: adb shell dumpsys activity recents lists current tasks, their components and last active times, without images. Record it before any interaction changes the list.
  • Interacting with the phone (opening Overview, launching apps) rewrites snapshots: minimise it before extraction.

Parsing

  • ALEAPP parses recent task XML and links the snapshot images into its report.
  • abx2xml (on the device) or ccl_abx (on a workstation) convert Android 12+ binary XML.
  • Commercial suites show recents with their images.

Investigator tips

  • Review every snapshot image: they are screenshots the user did not choose to take and may not know exist.
  • Compare last_time_moved with usagestats and Digital Wellbeing: consistent times across three stores are strong evidence.
  • A snapshot of a chat that no longer exists in the app database supports a deletion finding; check notification history too.
  • A missing snapshot for Signal or a private browser tab is expected when screen security is on; it is not a sign of tampering.
  • The pattern-of-life guide shows how recents fit with the other usage sources.

See also