Introduction
Determining when Android was installed on a mobile device can be a critical component of a digital forensic investigation. Investigators may need to establish whether a device was recently reset, reflashed, modified, or acquired by a suspect.
Unlike desktop operating systems, Android does not maintain a single, easily identifiable “installation date” artefact. Instead, forensic examiners must correlate multiple sources of evidence from file systems, partition metadata, system logs, application databases, and hardware information.
The reliability of installation-date determination depends on the acquisition method, device manufacturer, Android version, encryption status, and whether the device has undergone factory resets, operating system upgrades, or custom ROM installations.
Understanding Android Installation Events
The term “Android installation” may refer to:
- Initial installation performed by the manufacturer.
- Installation following a factory reset.
- Operating system update.
- Flashing of a stock firmware image.
- Installation of a custom ROM.
Each event leaves different forensic artefacts, requiring careful interpretation.
Primary Forensic Artefacts
1. File System Creation Timestamps
One of the most useful indicators is the creation time of the Android data partition.
Common partitions include:
- /data
- /system
- /cache
- /metadata
Investigators examine:
Bash tune2fs -l userdata.img
or
Bash dumpe2fs userdata.img
for ext4-based partitions.
Important metadata:
- Filesystem creation time
- Last mount time
- Last write time
Example:
Filesystem created: Tue Jan 15 10:22:45 2025
This may indicate:
- Initial device provisioning
- Factory reset
- Reinstallation of Android
However, some manufacturers recreate partitions during updates, making validation necessary.
2. Oldest File Within /data
The earliest timestamp within the user data partition frequently provides evidence of Android initialization.
Important locations include:
- /data/system/
- /data/misc/
- /data/user/
- /data/property/
Examples:
- /data/system/packages.xml
- /data/system/users/0.xml
- /data/system/locksettings.db
Creation timestamps often correspond closely with first boot after installation.
Investigators identify:
Bash find /data -type f | sort by timestamp
and establish the earliest surviving system file.
3. packages.xml
Location: /data/system/packages.xml
This file contains records of installed applications and package metadata.
Forensic value:
- Timestamp of creation
- First package installation times
- System application registration dates
The creation date of this file often reflects the first successful Android boot following installation.
Example entry:
XML
<package name="com.android.settings"
ft="1736820000" />
Epoch values can be converted to human-readable dates.
4. User Account Creation Artefacts
Android creates user profiles during initial setup.
Location: /data/system/users/
Files:
- 0.xml
- userlist.xml
These may contain:
XML
createdTime="1736819874000"
The timestamp often represents:
- Device setup completion
- Initial Android provisioning
This can be one of the most reliable indicators following a factory reset.
5. Lock Settings Database
Location: /data/system/locksettings.db
Contains information about:
- Screen lock configuration
- Credential setup
Creation timestamps frequently correlate with:
- First user configuration
- Initial device setup wizard completion
6. Android Property Files
Android stores persistent properties in /data/property/
Files such as:
- persist.sys.timezone
- persist.sys.locale
are generated during setup.
Earliest timestamps in this directory can help identify first boot after installation.
Build and Firmware Information
7. build.prop Artefacts
Location: /system/build.prop
Contains firmware information:
- ro.build.date
- ro.build.date.utc
- ro.build.version.release
Example:
ro.build.date=Mon Feb 10 15:14:02 UTC 2025
This indicates:
- Firmware compilation date
- Not installation date
Investigators should avoid confusing these values.
8. Boot Image Timestamps
Partitions:
- boot
- vendor_boot
- init_boot
Metadata may reveal:
- Flash date
- Build date
- Firmware deployment information
Useful when investigating reflashed devices.
Android Logs
9. Event Logs
Android event logs may contain evidence of:
- Setup Wizard execution
- User creation
- Device provisioning
Locations: /data/system/
and extracted log artefacts from:
- logcat
- event logs
- dropbox entries
Relevant events include:
- BOOT_COMPLETED
- DEVICE_PROVISIONED
- SETUP_COMPLETE
The earliest occurrence can indicate installation or reset.
10. DropBox System Logs
Location: /data/system/dropbox/
Android’s DropBox service stores:
- Boot logs
- Crash reports
- Setup-related events
Files frequently contain timestamps linked to the first operating-system startup.
Google Account Artefacts
11. Initial Account Setup Records
Android devices commonly create artefacts when a Google account is added.
Locations vary by Android version but may include:
- /accounts_ce.db
- /accounts_de.db
Found under:
- /data/system_ce/
- /data/system_de/
Creation times may establish:
- Earliest user activity
- Initial provisioning period
Factory Reset Indicators
Determining installation often requires differentiating between:
- Original installation
- Factory reset
Key indicators include:
New User IDs
/data/system/users/0.xml that is newly created after reset.
Fresh Encryption Keys
Android File-Based Encryption (FBE) creates /data/misc/vold/ key material.
Creation times often correspond to:
- Factory reset
- New installation
Setup Wizard Artefacts
System applications involved include:
- com.google.android.setupwizard
- com.android.provision
Fresh records indicate recent provisioning.
Android Upgrade Artefacts
Operating-system upgrades should not be mistaken for fresh installations.
Indicators of upgrades include:
OTA Update Logs
Locations /cache/recovery/ or /data/misc/update_engine/
Files:
- Plain text
- last_log
- last_install
- update_engine.log
These reveal:
- OTA installation dates
- Firmware update history
- Correlation Methodology
A forensic examiner should correlate multiple artefacts:
Artefact Reliability
User profile creation High
packages.xml creation High
Earliest files in /data High
Encryption key creation High
Setup Wizard records High
OTA update logs Medium
build.prop dates Low
Firmware compile dates Low
No single artefact should be relied upon in isolation.
Challenges and Limitations
Several factors complicate installation-date determination:
Factory Resets
A reset recreates many artefacts and can appear identical to a fresh installation.
Firmware Reflashing
Flashing stock firmware may replace partition metadata.
Clock Manipulation
Incorrect device time during setup can affect timestamps.
Root Access
A user with root privileges may alter timestamps.
Vendor Customisation
Manufacturers such as Samsung Electronics, Google, Xiaomi, and OnePlus store provisioning artefacts differently.
Conclusion
Identifying when Android was installed requires analysis of multiple forensic artefacts rather than reliance on a single installation date.
The most reliable indicators are user-profile creation records, packages.xml timestamps, filesystem creation metadata, encryption-key generation times, Setup Wizard artefacts, and early system files within the data partition.
By correlating these artefacts with update logs and firmware metadata, forensic investigators can establish a defensible timeline for Android installation, factory reset, or device reprovisioning.
Such analysis is particularly valuable in criminal investigations, civil litigation, corporate investigations, and incident response where establishing device history is essential.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
