I’m trying to interpret an Android forensic artefact. On a day X, the component com.miui.securitycenter was recorded as active twice. These entries occurred around the same time as activity attributed to Google Messages. The phone was reportedly powered off on day X and was not found or switched on again until the following day.
Could these entries indicate that the phone was powered on during day X, or do they show only that the component was active while Android was running? Can this artifact distinguish between two separate device boots and two component activations during a single session? Given the reported timeline, what alternative explanations should be considered, and what additional artifacts would be needed to determine whether the device was running on day X?
Device: Redmi Note 14 Pro
Android version: Android 14
Forensic tool/report and artifact name: Cellebrite Inseyets