Thanks in advance - I'm new here so apologies for any missteps.
I know Android (in my case, 6.0.1) maintains a structure for the Recent Apps, since it persists across power cycles. Does anyone know where that structure resides? Further, I'm hoping that structure timestamps them (last dispatch, slumber, etc). Does anyone know where that structure resides?
Basically, I've reviewed timelines from a couple forensic products without getting what I specifically need. I believe the "recent apps" is a true representation of the last activity but would like to know when they were in use.
Try the usage-history.xml file, gives list of installed apps, timestamps and last actions performed on the device (varies for each app but can be like last time the app was opened, last message sent, etc.).
usually located at
/data/system/usagestats/usage-history.xml
Hope that helps, let me know if you were aiming for something different but it's got some great information inside.
Jamie McQuaid
Magnet Forensics
Jamie, this really looks promising! Coincidentally, Axiom was already chewing on 30GB of .bin data - will it decipher those? Either way, I'm looking directly at some xml structures at /Root/system/usagestats/0/daily/nnnnnnnnnnnnn (no file type) …… I'll now look for something to describe the data but the key names are exciting. I've exported some of those files so if you know a quick way they can be interpreted, I'd be in your debt. Some of the timestamps are Unix/Epoch but I'm not sure of the others.
there is a DB file inside the folder com.android.vending. It maintains the list of all the apps installed and uninstalled along with date and time and the gmail id used to install. it may be of your help incase any app was installed/uninstalled recently. Let me know if it helps or if you don't find the file.
Hey Matt,
AXIOM will get the list of installed apps but it doesn't currently pull those additional timestamps I listed in the usage-history, you'll have to do those manually through the file system. I usually just save the file out and use either Notepad++ or your favourite XML viewer.
As for what each of them mean, it's very app dependent so you might have to do some testing on the ones that you're interested in but luckily most of the names are descriptive enough for you to understand what they actually do. It's not quite as easy as Apple, they list the data consistently for each app.
I haven't found a good doc that describes a lot of these values with Android but I'll take another look and post it if I find anything else that can help.
Jamie