Shutdown checkpoints-- for some reason,
and I don't know why I even say, for some reason,
because I get it.
It seems like people who want to commit murder or homicides
are now getting smarter, and they're
turning off their devices because they know.
The issues they make is they keep their watches on.
The other issue they have is they
will either do airplane mode, or they'll
put their device into Do Not Disturb,
or they'll turn it off and then turn it back on.
But guess what?
All those interactions leave a trace.
Shutting your phone down or rebooting it
leaves a checkpoint on Android 12.
Now, what's extremely important here--
you're going to find these files called checkpoint
with a timestamp.
That timestamp is a Unix Epoch timestamp
that is stored in local time.
So this is one of the very first times
that it has not been UTC--
very specific to local time.
It is going to track if the battery died.
Did the user power it down?
Why did it die?
So it's essentially telling you, this device
was powered down because of lack of battery.
This device was powered down, hard reboot.
So make sure you're examining this.
Josh Hickman wrote a nice blog on this
that's available as well.