MOBILE FORENSICS
Timestamps and metadata on Android
Timestamps and metadata are among the most important technical sources of information in an Android forensic investigation. They enable events to be placed in a chronological context and help to reconstruct technical sequences in a way that can be traced.
TECHNICAL BACKGROUND
Technical Fundamentals
Android stores time-related information in various formats and in different locations within the system.
Sources relevant to forensic investigations include, amongst others:
- •File system timestamp (MACB)
- •SQLite databases
- •XML and configuration files
- •Media metadata (EXIF)
- •App-specific time details
- •Synchronisation times
- •Unix Epoch and other time formats
- •Time zone information
Depending on the app and the version of Android, timestamps may be stored and interpreted differently.
OUR APPROACH
This is how your examination will be carried out
A transparent process – from the initial enquiry to the handover of the report.
TYPICAL QUESTIONS
When is this analysis required?
- ✔When was a file created or modified?
- ✔Which timestamps are reliable?
- ✔Which time zone was used?
- ✔Do the time details for different artefacts match?
- ✔What technical conclusions can be drawn?
LIMITATIONS & CONCLUSION
What you should know
Timestamps may be affected by synchronisations, system changes, imports, App-Updates or user input. They are therefore never assessed in isolation, but are always cross-checked against other artefacts.
Timestamps and metadata form the basis for reliable chronological reconstructions. Only by combining several independent data sources is it possible to carry out a sound forensic assessment.
CUSTOMER REVIEWS
What our customers say
4.8 out of 5 stars on Trustpilot · 54 reviews
“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”
idalein
Verified review on Trustpilot
“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”
Layla Pankratz
Verified review on Trustpilot
“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”
a woman from Cologne
Verified review on Trustpilot
Enquire now – free initial consultation
Would you like to have the timestamps and metadata from an Android device professionally analysed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.
RELATED TOPICS
You might also be interested in
FREQUENTLY ASKED QUESTIONS
Frequently Asked Questions
Click on a question to see the answer.