User activity is a fantastic way to say, OK,
not only was the device wiped at this time and then set up,
but the user with this username started using this device.
Now, if you look at usagestats--
and we're going to start examining this.
Under usagestats, you have to do a little bit of math
that I'm going to teach you.
But we have these different weekly stats.
The very first one will be when the user
started using that device.
AXIOM parses this nicely.
If you compare usagestats to the internal actual activity
for these containers-- so if you see
that usagestats shows two weeks ago,
but we have chats from 1/15/2019,
what do you think this is a symptom of?
This is a situation where the person wiped their Android,
use the same Google account, and put the apps back on it.
It pulls these files down and contains
historical information.
Think about when you get a new device and you set it up,
all of your stuff doesn't start from scratch.
All of your old stuff lands on the device.
I bet, if you compare the container date/time stamps
to the data that's inside of that,
you will actually see the difference.