Challenge LAB-0004

One question, three evidence sources

Compare what a full file system extraction, a bug report and a sysdiagnose can say about a restart, a permission use, a reset or an app opening, how far back each reaches, and whose clock stamps the date.

Expert 45 to 60 minutesAndroid and iOS8 questions, 165 pointsAlways open, self-paced
Start the questionsRead the article first

The task

A restart, a permission use or a reset can leave a trace in three kinds of evidence, but not the same trace. The article lets you pick a question and a source. Here you must read its figures closely and write only what the source supports.

All challenge data is synthetic or comes from the Lab's published articles. No account is needed, nothing you type here leaves your browser except each answer you check, and the optional form if you send it.

What you need

Tools (all free)

  • A plain text editor
  • A calculator or Python

Any tool that reads text will do. You do not need the Lab's own software or an account.

Questions

Each answer is checked when you press Check answer, and you see the result straight away. A wrong answer costs nothing, and you may try again. A hint lowers the points you can earn for that question: 3, 5 and 8 points for hints 1, 2 and 3, and a correct answer always earns at least 1 point. Checking needs JavaScript; reading does not.

  1. Question 1 of 820 points

    What is the median length, in hours, of the system log body inside an Android bug report?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See Figure 2 and the Summary.

    Hint 2 costs 5 points

    The longest was 3.1 hours.

    Hint 3 costs 8 points

    The median is one hour.

  2. Question 2 of 820 points

    A decoder without the log codec of iOS 27.0 archives recovered what percentage of the records while still reporting completion with warnings?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See the sysdiagnose cell for the restart question.

    Hint 2 costs 5 points

    The warning is that a decoder can finish and still lose almost everything.

    Hint 3 costs 8 points

    A single digit, with one decimal.

  3. Question 3 of 820 points

    How many distinct boot identifiers were counted in the 11.8-day sysdiagnose log?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    The other log, of 32.5 days, had only 2.

    Hint 2 costs 5 points

    See the restart question with the sysdiagnose source.

    Hint 3 costs 8 points

    More than twenty.

  4. Question 4 of 820 points

    Which kind of record can confirm one date and deny none?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See History, last use or state.

    Hint 2 costs 5 points

    Such a record keeps one date per subject.

    Hint 3 costs 8 points

    A history of events, by contrast, can be searched for a gap.

  5. Question 5 of 820 points

    On a second phone with two wipes, the gap between them was 118 days by header time and 644 days by requested time. By how many days do the two gaps differ?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    Subtract the smaller gap from the larger.

    Hint 2 costs 5 points

    644 minus 118.

    Hint 3 costs 8 points

    It is more than five hundred days.

  6. Question 6 of 820 points

    In a bug report, the system log reached back one hour and holds no record of a restart. Which sentence is supported?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See A routine you can repeat, the last step.

    Hint 2 costs 5 points

    The article's own example sentence says the same.

    Hint 3 costs 8 points

    A negative from a bug report is not a negative from an extraction.

  7. Question 7 of 820 points

    For a day 30 days before acquisition, on how many of the 33 iPhones was app use answerable?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See the app-use cells and the closing paragraph under Figure 1.

    Hint 2 costs 5 points

    The same question was answerable on 0 of 14 Android phones.

    Hint 3 costs 8 points

    More than half of the iPhones.

  8. Question 8 of 825 points

    Select the dates that are written in local time, not in UTC.

    Select all that apply.

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 3 points

    See Figure 3, the column Year and zone.

    Hint 2 costs 5 points

    Two of the four options are local time. The Android boot-reason history is epoch seconds.

    Hint 3 costs 8 points

    The requested time of a reset, and the process statistics with Samsung battery files.

You have finished: what you should have learned

  • A boot history, a log line, a count and a last-use time are four different things. Name the store, then say whether it keeps history, a last use or a state.
  • An empty result is an answer only if the store reached back to the day in question. State the window of each source before you report a negative.
  • A date is only as good as its clock. Some dates carry no year, some are local time with no zone, and one recovery clock printed 1970.
  • The three sources did not come from one phone, so the article compares what each holds, not whether they agree.
Next challenge by number: What a missing setting meansSee your progress mapRead the article again

Completion note

Typed here only. It appears on the printed note and is not saved or sent anywhere.

UpDownto moveEnterto openEscto close