Device-Life Boundary Indicators and the Classification of Restored Versus Native Records on Android

Daniel Kwaku Ntiamoah Addai, Selorm Adjabeng, Kingsley Albert Egyir, Sanders Larweh Tetteh

A phone that shows calls, messages and photographs from years ago may have been set up recently and carried them over from an earlier handset, so its screen dates do not date the device's own life. Which traces fix where that life begins, how well they agree and how much of what is visible predates it is unmeasured. We read 14 Android full file system extractions (12 Samsung; Android 10 to 16), seven bug reports and 33 iOS extractions (a probe). Every Android device recorded a first boot, but the first evidence of user setup came a median of 98 days later (0 to 563). Of the 13 devices with messages, 7 held some dated before the first boot, a majority of them on 5; 24% of the apps outside the system image were installed as restored. Against the creator field that a migration tool leaves on messages, a boundary at user setup recalled all but 1 of 46,968 such messages, the first-boot boundary 94 to 100%. On synthetic fixtures, the labelling error followed the boundary error. A date on a record dates the device only once the record is shown to have been created on it.