Area 06
Android records app activity for its own scheduling, battery and wellbeing features, and that record is often the best proof that a user opened an app at a given time. This area covers the usagestats event files (XML then protobuf), the Digital Wellbeing database, battery and power statistics in bugreports, recent tasks snapshots and notification history.
Key artifacts
Android usagestats files: app foreground and background events, screen and keyguard state, XML and protobuf formats, paths per version and retention.
Android 8-16
Google Digital Wellbeing's app_usage database on Android 9+: app open and close events, unlocks and notifications, Samsung's variant, retention and parsing.
Android 9-16
Android batterystats: battery history of screen, charging, top app, wakelocks and radios, from dumpsys, bugreports and batterystats.bin, with time decoding.
Android 8-16
Android recent tasks XML and task snapshot images in system_ce: what the Overview screen stored, last active times, screenshots of app screens, FLAG_SECURE.
Android 8-16
Android notification evidence: Android 11+ notification_history protobuf files with title and text, notification_log.db on 8 to 10, and dumpsys notification.
Android 8-16
Prove when an Android phone was used and which app was on screen: usagestats, Digital Wellbeing, batterystats, recent tasks and notifications, combined.