Usagestats

Usagestats is the data store of Android's UsageStatsService, the system service that tracks app activity for features such as app standby buckets, Digital Wellbeing and the "recently used apps" logic. It records timestamped events for each user: an activity resumed or paused, the screen turned interactive or off, the keyguard shown or hidden, the device started up or shut down, a notification interrupted the user, a foreground service started.

Events and aggregates are written into interval folders named daily, weekly, monthly and yearly, one file per period, named after the period's start time in Unix milliseconds. Android 8 and 9 write XML; Android 10 switched to protobuf, and Android 11 moved the store to credential-encrypted storage and replaced package names with tokens resolved through a mappings file. Detailed events are kept for days, aggregates for months to years.

For investigators it is often the best evidence that a user actually opened an app at a given time, and keyguard events help place unlocks. It does not say what the user did inside the app. A live device's recent events can also be read with adb shell dumpsys usagestats, and bugreports include that dump. Full details, paths per version and parsing are on the usagestats artifact page.