Mobile Forensics · Timelines & Analysis · Lesson 3 of 5

App Usage Artifacts

What screen time and notification records can show, and what they can't.

Screen time, on the record

Both Android and iOS keep track of how the phone is used, mostly so they can show you your own habits. For an examiner working under a warrant or with consent, these records can show when the phone was active and which apps were on screen. In forensics, any trace left behind by normal use is called an artifact.

On Android, the system records app usage statistics: which apps came to the foreground, when, and for how long. Apps can only read this data if the user grants a special permission called usage access in Settings. Google's Digital Wellbeing dashboard is built on this kind of data. Its chart shows screen time per app, how often the phone was unlocked and apps were opened, and how many notifications arrived from which apps.

On iPhone, Screen Time does a similar job. Its reports show time spent in apps, the most used apps, pickups (how often the phone was picked up) and notification counts, by day and by week.

One setting deserves extra care. With Share Across Devices turned on, Screen Time can combine activity from the user's iPhone, iPad and Mac signed in to the same Apple Account. A Screen Time report on the phone may then include time spent on a different device in a different room.

Behind these screens sit internal system databases. Neither Apple nor Google documents them for examiners, and their names, formats and how long they keep data change between versions. Forensic tools parse them, usually from a full file system acquisition rather than a basic logical one. An examiner should know which OS version the phone ran and treat the tool's interpretation as something to verify, not the final word.

What app use can and can't prove

Notifications are another useful artifact. On Android 11 and later, a feature called notification history can keep a list of recent notifications. It's usually off by default, and it only covers a short window, often described as about the last 24 hours, so it may hold nothing useful. Separately, some apps keep their own records of notifications they showed. Exact behavior varies by phone maker and version.

A notification record shows that a message or alert reached the phone at a certain time. It doesn't show that anyone read it. The preview may have appeared on a locked screen in an empty room.

Usage records have a similar limit. Suppose the data shows a messaging app in the foreground at 23:14 UTC. What does that prove?

• It strongly suggests the phone was on and in use at that time, if the clock was right.
• It does not show who was holding it. Families share phones, friends borrow them, and people share passcodes.
• Not every foreground moment means a person tapped something. Some apps come forward on their own, such as an alarm or an incoming call screen.

To link use to a person, examiners look for other evidence that points at one individual. Examples include messages written in that person's style, a selfie taken a minute later, or the phone's location matching where a specific person was known to be. Each one adds weight. None is perfect alone.

When you write it up, use careful words. Say the device showed activity in an app at a given time. Don't write that the suspect used the app, unless other evidence supports that step.