Daniel Kwaku Ntiamoah Addai, Selorm Adjabeng, Kingsley Albert Egyir, Sanders Larweh Tetteh
原文摘要
A phone that shows calls, messages and photographs from years ago may have been set up recently and carried them over from an earlier handset, so its screen dates do not date the device's own life. Which traces fix where that life begins, how well they agree and how much of what is visible predates it is unmeasured. We read 14 Android full file system extractions (12 Samsung; Android 10 to 16), seven bug reports and 33 iOS extractions (a probe). Every Android device recorded a first boot, but the first evidence of user setup came a median of 98 days later (0 to 563). Of the 13 devices with messages, 7 held some dated before the first boot, a majority of them on 5; 24% of the apps outside the system image were installed as restored. Against the creator field that a migration tool leaves on messages, a boundary at user setup recalled all but 1 of 46,968 such messages, the first-boot boundary 94 to 100%. On synthetic fixtures, the labelling error followed the boundary error. A date on a record dates the device only once the record is shown to have been created on it.
Daniel Kwaku Ntiamoah Addai, Sanders Larweh Tetteh, Selorm Adjabeng, Kingsley Albert Egyir
原文摘要
Whether an extraction can answer a question about a given day depends on how far back each store reaches, yet public statements rest on single test devices. We measured the retention horizon, the time from a store's oldest retained record to acquisition, for eight iOS and seven Android stores on 48 full file system extractions and seven bug reports, keeping devices whose clock agreed with the acquisition time (26 Apple devices, 13 Android phones). Horizons ranged from minutes to years and followed the mechanism that bounds each store. The unified log Persist stream reached a median of 2.5 days; interactionC reached 166 to 170 days on 18 of 25 devices. Android stores stayed within their source-code limits (usage statistics 10.2 days, DropBox 3.1, notifications 1.5); bug-report logs reached 3.1 hours at most. The oldest record misled three times: one knowledgeC stream reached back two years, the others a median of 29 days; interactionC read without its write-ahead log showed older records on 18 of 25 devices; and four of seven bug reports began with stray lines up to 16.6 days old above a body of 3.1 hours or less. A horizon belongs to a store, a release and a device.