Now, I realize there's a lot of information on this slide,
and we're going to cover some of these in detail.
But if you're trying to prove an app was used,
there are so many traces everywhere.
Remember, every contact leaves a trace.
So as we look at this, what I recommend--
first, look at the timestamps in the application directory.
When was the app directory created?
And how does that compare to the date/time stamp
in localappstate.db?
Localappstate.db will track the time
it was first installed, last installed, last updated,
if it's been reloaded, the Google account associated
to it, is it set to auto update?
All of these things will be in play.
After that, usagestats-- going to be
a huge part of this section.
We are going to examine that in the second part of Lab 2.2.
So we're going to start looking at usagestats.
You can use ALEAPP.
You can use other tools to do this.
Launcher.db is exactly what it sounds like.
When were applications launched?
Very helpful.
Downloads.db, which applications were downloaded?
ContextLog_0 and ContextLog-- I'm
going to show you this in a moment.
It's only present on Android 7 to 10 devices.
So it's no longer on 11 and 12, but it
is very helpful at what is going on the device moments
before a period in time.
App_idle-- when you look at app_idle stats,
when you send an application to the background or something
interrupts you, it's how long is the app waiting
on you to focus on it again.
Frosting-- this is the sweet one that
tracks sideloaded applications, apps
loaded from the App Store or the Play Store, everything.
We're going to look at cast.db.
We're going to look at notification_log.db.
And we're going to look at app_usage,
which is digital wellbeing.
So lots of things that we are going to start looking at,
and I have some screenshots here.
All of these are on your cheat sheet as well.
You're going to be looking at them in your lab.
They are relevant and will be of interest to you.