Datasets

Datasets

Synthetic teaching artifacts. Each set is written by a script from a fixed seed, built from what the Lab learned on real devices provided to the Lab by partners. Every file is invented, so no case data is exposed. Each comes with reference answers that say what is in it, so you can test a tool, a method or a model against known facts.

Platform
Evidence
Use

Datasets

DS-0001 to DS-0004 are file sets: folders that look like what a tool reads from a phone, for testing parsers and readers. DS-0005 to DS-0007 are teaching sets for supervised learning: labelled tables of invented examples with a train file, a test file, a baseline, an evaluation script and a teaching guide.

  • DS-0001

    Samsung reset and recovery: paired extractions

    12 invented Samsung handsets, each as a full file system folder view and a bug report view of the same phone, reset at known times with SIM region changes between. No file comes from a device. Each pair has reference answers.

    Device class
    None (invented Samsung-style handsets)
    OS
    Android 16 class, invented build names
    Evidence
    Full file system view, Bug report view (synthetic)
    Size
    93 KB zip (95,730 bytes), 179 files

    Reference answersPer pair and per run: what the full file system view shows, what the bug report shows and how directly. 24 resets and 26 region changes in 12 pairs.

    Full file system viewBug report viewVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) a1b27e2374927cbc...

    Open the dataset
  • DS-0002

    iPhone sysdiagnose-style set

    34 invented iPhone sysdiagnose-style folders written by a script from a fixed seed, each for a scripted sequence of known actions: an app install, a Wi-Fi join, airplane mode on and off, an app crash and an app removal. No file comes from a device.

    Device class
    None (generated files)
    OS
    iOS 26 class layout, invented build
    Evidence
    Synthetic sysdiagnose-style folders
    Size
    229 KB zip (234,001 bytes), 178 files

    Reference answersPer case: every scripted action with its true time and the files that hold its trace, plus what a correct reader should list. 175 actions in 34 cases.

    Synthetic filesVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) efb13ec545321739...

    Open the dataset
  • DS-0003

    Synthetic Pixel-class full file system baseline

    26 invented Pixel-class device folder trees written by a script from a fixed seed, in the layout the public ALEAPP parser reads, after a short script: an account added, two apps installed and one removed, a Wi-Fi network joined and a Bluetooth headset paired. No file comes from a device.

    Device class
    None (generated files)
    OS
    Android 16 class layout, invented build
    Evidence
    Synthetic full file system folders
    Size
    430 KB zip (440,095 bytes), 683 files

    Reference answersPer case: every scripted action with its true time and the file where its trace sits, what the removed app left in each store, and bounds on the removal time. 168 actions in 24 handsets, plus 2 controls from before the script.

    Synthetic filesVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) 38e2bddc3a94a205...

    Open the dataset
  • DS-0004

    Synthetic recovery-history set

    56 invented Samsung-style recovery histories written by a script from a fixed seed, in the layout described in LAB-0001. No file comes from a device. Each case has a reference answer.

    Device class
    None (generated files)
    OS
    Not applicable
    Evidence
    Synthetic files
    Size
    66 KB zip (67,961 bytes), 153 files

    Reference answersPer case: which runs are factory resets, which are SIM region changes, which sit on a 1970 clock, and the wipe count. 61 wipes and 102 region changes in 56 cases.

    Synthetic filesVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) e78c22d28785411b...

    Open the dataset
  • DS-0005

    Factory-reset classifier set

    A teaching set for supervised learning: 2,000 invented phone records with 22 artifact features and the question "factory reset in the last 30 days?". Train and test files, a hand-written baseline, an evaluation script and a teaching guide. Every row is synthetic.

    Device class
    None (generated table of Android-style features)
    OS
    Not applicable
    Evidence
    Synthetic table
    Size
    179 KB zip (182,901 bytes), 17 files

    Reference answersTest labels kept in a separate file, with each phone's profile and true reset age. Built-in traps: a leakage column, a 5 percent positive variant and clock-tampered rows.

    Teaching setSynthetic tableVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) 22621655320ddf47...

    Open the dataset
  • DS-0006

    Stalkerware permission profiles

    A teaching set for classification: 3,000 invented Android app profiles (permissions, accessibility service, device administrator, hidden icon, install source, App Ops counts) and the question "stalkerware or benign?". Benign look-alikes on purpose, a leakage column, a baseline and a guide on the cost of false positives. Every row is synthetic.

    Device class
    None (generated table of Android-style app features)
    OS
    Not applicable
    Evidence
    Synthetic table
    Size
    118 KB zip (120,610 bytes), 12 files

    Reference answersTest labels in a separate file, with each app's family. 225 stalkerware rows in 3,000 (7.5 percent). Built-in traps: a leakage column, class imbalance, benign parental-control, remote-support, accessibility and backup apps that look like stalkerware, and covert use of a dual-use app.

    Teaching setSynthetic tableVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) 3a5ced10a2dc7499...

    Open the dataset
  • DS-0007

    Synthetic network beacon flows

    A teaching set for supervised learning: 2,964 invented per-destination flow summaries from 150 phones and the question "command-and-control style beaconing or normal app traffic?". Interval, jitter, size and destination features, regular benign traffic on purpose, a leakage column, a baseline and a guide. Every row is synthetic.

    Device class
    None (generated table of flow features)
    OS
    Not applicable
    Evidence
    Synthetic table
    Size
    142 KB zip (144,993 bytes), 16 files

    Reference answersTest labels in a separate file, with each flow's traffic family. 347 beaconing rows in 2,964 (11.7 percent). Built-in traps: a leakage column, class imbalance, a fixed-interval shortcut that fails with jitter, and benign push, time-sync and device-management traffic that is as regular as a beacon.

    Teaching setSynthetic tableVersion 1.0Data CC BY 4.0, code MIT

    Set hash (manifest.json) b41cd1b7f648b4dd...

    Open the dataset

How the datasets are made

Every set is written by a script from a fixed seed, so anyone can rebuild it byte for byte. The script decides the facts first (which phone was reset and when, which app was removed, which flow is a beacon), writes them into the files, and keeps the facts in separate reference answers.

Built from what the Lab learned on real devices provided to the Lab by partners; every file here is synthetic, so no case data is exposed. A synthetic set teaches a method. It does not measure how accurate a tool is on real devices.

Licence and hosting

Data is CC BY 4.0 and code is MIT. There is nothing to accept before you download: credit the Lab, say that the files are synthetic, and keep the hashes beside any copy you share.

The sets are served from this site, versioned. Each dataset page links to its zip, its manifest and its SHA-256 hashes, and prints the hash of the zip so you can check your copy.

UpDownto moveEnterto openEscto close