{ "_about": "Category map of LAB-0002, Figure 1. Section names and counts only; no values from any report.", "_sample": "Five reports from our test collection. Counts are of this sample, not a statistic.", "_licence": "CC BY 4.0", "categories": [ { "id": "device", "category": "Device and build", "group": "Device and software", "anchor_section": "SYSTEM PROPERTIES", "anchor_present_in_reports_of_5": 5, "sections": "System properties, report header, time zone data, hardware properties, build flags (3 of 5), platform compatibility (3 of 5), fonts.", "what_it_holds": "The description of the build: Android version, patch level, build identity and the properties the system reports about itself.", "questions": [ "Which Android version and patch level is this?", "Is this the manufacturer build the examiner expects?", "Which time zone data does the device carry?" ], "limit": "Values at capture time. A property that changed earlier is not shown unless the section keeps history." }, { "id": "apps", "category": "Installed apps and components", "group": "Device and software", "anchor_section": "package", "anchor_present_in_reports_of_5": 5, "sections": "package (tens of thousands of lines), check-in package data, application activities, services and providers, overlays, widgets, shortcuts (3 of 5).", "what_it_holds": "Every installed package with its version, installer, install and update times, flags and the components it declares.", "questions": [ "Which apps are installed, and which installer put them there?", "When was an app installed or last updated?", "Which components does an app expose to others?" ], "limit": "State at capture: what is installed now. Cut by the time limit in one report of five." }, { "id": "settings", "category": "Settings and configuration flags", "group": "Device and software", "anchor_section": "settings", "anchor_present_in_reports_of_5": 5, "sections": "settings (system, secure and global tables, with history on Android 16), device config (3 of 5).", "what_it_holds": "The values of the settings tables, and on Android 16 a history of changes to them.", "questions": [ "Is developer mode or USB debugging on?", "Is installing from unknown sources allowed?", "Did a setting change, and in what order?" ], "limit": "A setting says what is configured, not who set it. History exists only where the build keeps it." }, { "id": "vendor", "category": "Vendor and hardware", "group": "Device and software", "anchor_section": "HARDWARE HALS", "anchor_present_in_reports_of_5": 5, "sections": "Hardware interface list (5 of 5), Samsung quality-monitoring and security services (2 of 5), Motorola settings, Huawei power manager, Transsion performance framework.", "what_it_holds": "What the manufacturer added: its own services and their dumps, next to the common hardware interface list.", "questions": [ "Which vendor services exist on this build?", "Which hardware interfaces does the device declare?" ], "limit": "No common layout. Names and contents differ for every manufacturer, so read each as its own format." }, { "id": "perms", "category": "Permissions, app ops and roles", "group": "Access and policy", "anchor_section": "appops", "anchor_present_in_reports_of_5": 5, "sections": "app ops (thousands to over a hundred thousand lines), permission lines inside package, permission manager (3 of 5), roles (3 of 5).", "what_it_holds": "Which permissions each app holds, which operations it is allowed to perform, and when an operation was last used.", "questions": [ "Which apps hold a sensitive permission?", "When did an app last use an operation such as camera or location?", "Which app holds a role such as default dialer?" ], "limit": "Grants and last-use times, not what the app did with the access." }, { "id": "security", "category": "Security and device policy", "group": "Access and policy", "anchor_section": "lock_settings", "anchor_present_in_reports_of_5": 3, "sections": "Device policy, lock settings (3 of 5), fingerprint (3 of 5), face (4 of 5), trust agents (3 of 5), ADB state, Samsung security services (2 of 5).", "what_it_holds": "Whether a screen lock is set, which biometrics are enrolled, whether a device administrator or management policy is active, and the ADB state.", "questions": [ "Is a screen lock configured, and of which type?", "Is a device administrator or management policy active?", "Is USB debugging enabled?" ], "limit": "ADB keys and signer certificates are not in a bug report, and the lock secret never is." }, { "id": "accounts", "category": "Accounts, users, sync and backup", "group": "Access and policy", "anchor_section": "account", "anchor_present_in_reports_of_5": 5, "sections": "accounts, content and sync (5 of 5), backup (5 of 5), users (3 of 5), health data service (3 of 5).", "what_it_holds": "Which accounts are on the device and of what type, which users exist, which sync adapters ran and when, and the backup state.", "questions": [ "Which accounts are signed in?", "Is there more than one user or a work profile?", "Is backup on, and when did a sync last run?" ], "limit": "Account names are personal data. Public articles describe the field, never a value." }, { "id": "usage", "category": "App usage", "group": "Activity", "anchor_section": "CHECKIN USAGESTATS", "anchor_present_in_reports_of_5": 5, "sections": "usage statistics check-in (5 of 5), usage events (3 of 5), graphics statistics, frame statistics (4 of 5).", "what_it_holds": "Which apps came to the foreground and left it, over about the last 24 hours, with the usage buckets the system assigned.", "questions": [ "Which app was in use around a time of interest?", "How long was an app in the foreground in the last day?" ], "limit": "A window of about 24 hours. Nothing before it is available." }, { "id": "procs", "category": "Running processes, memory and app kills", "group": "Activity", "anchor_section": "activity", "anchor_present_in_reports_of_5": 5, "sections": "activity manager (5 of 5), process statistics, processes and threads, memory (cut in two reports), CPU, binder state, process exit info (3 of 5).", "what_it_holds": "What was running at capture, how much memory each app held, and why recent processes were stopped.", "questions": [ "What was running when the report was taken?", "Why did an app process end (crash, kill, user)?" ], "limit": "A snapshot plus a short exit history. The activity section was cut by the time limit in two reports of five." }, { "id": "jobs", "category": "Alarms and jobs", "group": "Activity", "anchor_section": "jobscheduler", "anchor_present_in_reports_of_5": 5, "sections": "job scheduler (5 of 5, thousands of lines), alarm manager (5 of 5).", "what_it_holds": "Work apps have scheduled for later, and the alarms that were set or fired.", "questions": [ "What is an app set to run later, and when?", "Which alarms woke the device?" ], "limit": "Shows what is scheduled, not what ran. Scheduled work is not evidence of use." }, { "id": "notif", "category": "Notifications", "group": "Activity", "anchor_section": "notification", "anchor_present_in_reports_of_5": 5, "sections": "notification service (5 of 5), status bar.", "what_it_holds": "Notification channels per app, the apps allowed to listen to notifications, and recent notification records.", "questions": [ "Which apps can post or read notifications?", "Which channels does an app define?" ], "limit": "A snapshot of channels, listeners and recent records, not a full history." }, { "id": "display", "category": "Display, input and accessibility", "group": "Activity", "anchor_section": "input_method", "anchor_present_in_reports_of_5": 4, "sections": "accessibility, input method (4 of 5), window manager, display, compositor, input.", "what_it_holds": "The keyboards installed and selected, the accessibility services that are enabled, and the display and window state.", "questions": [ "Which keyboard is active?", "Which accessibility services are enabled?" ], "limit": "Configuration at capture. An enabled service is not proof that it was used." }, { "id": "net", "category": "Network and connectivity", "group": "Connectivity", "anchor_section": "netpolicy and connectivity", "anchor_present_in_reports_of_5": 5, "sections": "network policy, connectivity, name resolver, network daemon, sockets, firewall rules and routes, tethering (3 of 5), per-app data check-in (2 of 5).", "what_it_holds": "The network state at capture: interfaces, policy and restrictions, resolver settings, and where it exists, per-app data counters.", "questions": [ "Which network was the device on?", "Which apps have data restrictions?", "Which apps used mobile or Wi-Fi data (where per-app counters exist)?" ], "limit": "No network destinations. Per-app counters were in only the two Samsung reports of our sample." }, { "id": "wifi", "category": "Wi-Fi", "group": "Connectivity", "anchor_section": "wifi", "anchor_present_in_reports_of_5": 5, "sections": "Wi-Fi service (5 of 5), scanner, direct connections, Samsung Wi-Fi extension (2 of 5; cut in one).", "what_it_holds": "Saved networks, connection events and the scanner state.", "questions": [ "Which Wi-Fi networks does the device know?", "When did it connect or disconnect?" ], "limit": "Saved-network names are personal data. Public articles describe the field, never a value." }, { "id": "bt", "category": "Bluetooth, NFC and USB", "group": "Connectivity", "anchor_section": "bluetooth_manager", "anchor_present_in_reports_of_5": 5, "sections": "Bluetooth manager (5 of 5, bonded devices and events), NFC (4 of 5), USB (3 of 5), USB log (2 of 5).", "what_it_holds": "Paired Bluetooth devices and recent adapter events, NFC state, and USB mode and connection events.", "questions": [ "Which Bluetooth devices has the phone paired with?", "Was a USB connection made?" ], "limit": "Event windows are short; the USB log was in two reports of five." }, { "id": "tel", "category": "Telephony and messaging", "group": "Connectivity", "anchor_section": "RADIO LOG", "anchor_present_in_reports_of_5": 5, "sections": "radio log (5 of 5), phone, carrier configuration, messaging and subscription services, telephony registry (3 of 5), telecom (3 of 5).", "what_it_holds": "The radio layer: registration state, carrier configuration, subscriptions and what the radio logged.", "questions": [ "Which carrier configuration is active?", "What did the radio layer log around a time of interest?" ], "limit": "No message bodies and no call content: only state and logs of the radio layer." }, { "id": "power", "category": "Battery and power", "group": "Power, location and sensors", "anchor_section": "batterystats", "anchor_present_in_reports_of_5": 5, "sections": "battery statistics (5 of 5, the largest section), battery check-in, power manager, idle controller, battery, thermal (3 of 5).", "what_it_holds": "Per-app power use, screen and charging events and idle behaviour, over about one day.", "questions": [ "Which apps used the most power?", "When was the screen on, and when was the device charging?" ], "limit": "About one day. The very large size does not mean a long window." }, { "id": "loc", "category": "Location and sensors", "group": "Power, location and sensors", "anchor_section": "location", "anchor_present_in_reports_of_5": 5, "sections": "location manager (5 of 5), sensor service, location time-zone manager (3 of 5).", "what_it_holds": "The state of the location manager: providers, and the apps that request location.", "questions": [ "Which location providers are on?", "Which apps request location?" ], "limit": "Not a location history." }, { "id": "media", "category": "Camera, microphone and media", "group": "Power, location and sensors", "anchor_section": "media.camera", "anchor_present_in_reports_of_5": 5, "sections": "camera service (5 of 5, thousands of lines), audio, audio flinger, audio policy, media metrics, player, session and projection.", "what_it_holds": "Events of apps that use the camera, audio state and which app is projecting or recording.", "questions": [ "Which app opened the camera recently?", "Is a screen recording or projection active?" ], "limit": "Recent events only. Pictures and recordings are never in a bug report." }, { "id": "storage", "category": "Storage, filesystem and databases", "group": "Power, location and sensors", "anchor_section": "dbinfo", "anchor_present_in_reports_of_5": 5, "sections": "database info (5 of 5, cut in one), mounts, storage daemon (3 of 5), disk statistics, filesystems and free space.", "what_it_holds": "Mounted volumes, free space and the databases apps have open, by name and size.", "questions": [ "How full is storage?", "Which databases does an app hold open?" ], "limit": "Names and sizes, never the contents of a file or database." }, { "id": "logs", "category": "Logs", "group": "Logs and failures", "anchor_section": "SYSTEM LOG", "anchor_present_in_reports_of_5": 5, "sections": "system log (5 of 5), event log, radio log, kernel log (4 of 5), last kernel messages (3 of 5), statistics log.", "what_it_holds": "The system and event logs, and the kernel log of the last boot where it is kept.", "questions": [ "What happened around a time of interest?", "Which component logged an error?" ], "limit": "The body of the log runs from a few minutes to about three hours between reports. A few older stray lines can sit above it, so find where the dense part begins as well as the first line. Check the start of the body and the last line before concluding that nothing happened." }, { "id": "boot", "category": "Boot, crash, ANR and tombstones", "group": "Logs and failures", "anchor_section": "dropbox", "anchor_present_in_reports_of_5": 5, "sections": "dropbox entries (5 of 5), tombstones, ANR traces, VM traces, reset reasons (2 of 5), boot properties, update engine (1 of 5).", "what_it_holds": "Crash and not-responding records, native crash dumps, why the device last restarted, and whether an update ran.", "questions": [ "Did an app crash or hang?", "Why did the device last restart?" ], "limit": "Includes the boot reason history discussed in LAB-0001. A missing entry is not proof that nothing happened." } ] }