Area 09
A phone keeps time in several formats at once: Unix milliseconds in most databases, seconds in MMS, WebKit microseconds in Chrome, offsets from a file's own start time in usagestats. This area covers converting them all to UTC, building a device timeline with ALEAPP and Plaso output, and pivoting from an anchor event such as an app install or a first message.
Key artifacts
Android usagestats files: app foreground and background events, screen and keyguard state, XML and protobuf formats, paths per version and retention.
Android 8-16
Google Digital Wellbeing's app_usage database on Android 9+: app open and close events, unlocks and notifications, Samsung's variant, retention and parsing.
Android 9-16
Android notification evidence: Android 11+ notification_history protobuf files with title and text, notification_log.db on 8 to 10, and dumpsys notification.
Android 8-16
Android's package manager state: packages.xml install and update times, installer and initiator, UIDs, signatures and permissions, packages.list and ABX.
Android 8-16
Google Location History and Maps Timeline: the legacy cloud Records.json, the 2024 to 2025 move to on-device storage, Timeline.json exports and what remains.
Android 8-16
The Android telephony provider database holding SMS and MMS: tables, timestamps in ms and seconds, MMS parts, RCS caveats and deleted records.
Android 8-16
Chrome's History SQLite database on Android: visited URLs, per-visit transitions, downloads and search terms, WebKit timestamps, synced visits and retention.
Android 8-16
Build an Android device timeline: every timestamp format on the phone, converting to UTC, ALEAPP and Plaso output, merging sources, and pivoting from anchors.