MOBILE FORENSICS

Forensic analysis of Android timestamps and time zones

Time-related information is among the most important pieces of evidence in a mobile IT forensic investigation. Only by correctly interpreting timestamps is it possible to reconstruct the sequence of events and create reliable timelines.

Unix Epoch / Unix Time
UTC and local time
Time zone information
SQLite time formats
File system timestamps (e.g. ext4, F2FS)
App-specific timestamps
Browser and messaging app usage statistics
Synchronisation times
Metadata and event logs

TECHNICAL BACKGROUND

Technical Fundamentals

Android uses different time formats and time sources.

Information relating to time that is relevant in a forensic context includes, amongst other things:

  • •Unix Epoch / Unix Time
  • •UTC and local time
  • •Time zone information
  • •SQLite time formats
  • •File system timestamps (e.g. ext4, F2FS)
  • •App-specific timestamps
  • •Browser and messaging app usage statistics
  • •Synchronisation times
  • •Metadata and event logs

The way the date and time are displayed may vary depending on the app and the version of Android.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a forensic data backup, timestamps from file systems, databases, applications and logs are analysed using recognised IT forensic tools and manual analysis. Different time formats are standardised and correlated with one another to create a consistent timeline. All stages of the investigation are documented in a manner that ensures traceability.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What time format is used?
  • ✔Have the times been saved correctly in UTC or local time?
  • ✔Do the timestamps of various artefacts match?
  • ✔Can events be reconstructed chronologically?
  • ✔What sources of error need to be taken into account when interpreting the results?

LIMITATIONS & CONCLUSION

What you should know

Incorrectly configured times, missing time zone information, manual changes or incomplete data can make interpretation difficult. Individual timestamps must therefore not be assessed in isolation, but must be cross-checked against other technical artefacts.

The correct analysis of timestamps is a key prerequisite for reliable IT forensic reports. Only by correlating different time sources is it possible to reconstruct technical events in a verifiable manner.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the timestamps from an Android device professionally analysed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Why is UTC important?
UTC serves as a standard reference and makes it easier to compare different data sources.
Do all apps use the same time format?
No. Different time formats are used depending on the application.
Can timestamps be tampered with?
Individual dates may be subject to change. For this reason, several artefacts are always compared with one another.
Do time zones matter?
Yes. An incorrect conversion can lead to incorrect chronological ordering.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.