Retention Horizons of Volatile Stores in iOS and Android Extractions

Daniel Kwaku Ntiamoah Addai, Sanders Larweh Tetteh, Selorm Adjabeng, Kingsley Albert Egyir

Whether an extraction can answer a question about a given day depends on how far back each store reaches, yet public statements rest on single test devices. We measured the retention horizon, the time from a store's oldest retained record to acquisition, for eight iOS and seven Android stores on 48 full file system extractions and seven bug reports, keeping devices whose clock agreed with the acquisition time (26 Apple devices, 13 Android phones). Horizons ranged from minutes to years and followed the mechanism that bounds each store. The unified log Persist stream reached a median of 2.5 days; interactionC reached 166 to 170 days on 18 of 25 devices. Android stores stayed within their source-code limits (usage statistics 10.2 days, DropBox 3.1, notifications 1.5); bug-report logs reached 3.1 hours at most. The oldest record misled three times: one knowledgeC stream reached back two years, the others a median of 29 days; interactionC read without its write-ahead log showed older records on 18 of 25 devices; and four of seven bug reports began with stray lines up to 16.6 days old above a body of 3.1 hours or less. A horizon belongs to a store, a release and a device.