DS-0004

Synthetic recovery-history set

56 recovery histories written by a script, in the layout described in LAB-0001. Every case has a reference answer, so you can test a reader or a parser against known facts. The values are invented and no file comes from a device.

Synthetic filesVersion 1.0Data CC BY 4.0Code MIT

Get the dataset See one case Try the challenge

At a glance
Reference answers
One case
Download and licence
Hashes
Cite

At a glance

What the set is, how it was made, and how it may be used.

Describes the same files as LAB-0001. Plain text, so any editor opens them.

Device class: None (generated files)
OS: Not applicable
Evidence type: Synthetic files
Made on: A script (generate.py, Python standard library) with seed 20261106. No device, no case data and no real identifiers. The same seed gives the same bytes.
Contents: 56 cases in 7 categories, 184 history entries (61 factory resets, 102 SIM region changes and 21 other runs, which are update-package runs with a locale). 148 case files, 153 files in the zip.
Size: 66 KB as a zip (67,961 bytes)
Version: 1.0
Licence: Data: CC BY 4.0. Generator code: MIT.
Maintainer: Daniel Addai, SectraTEK Lab

Reference answers

56 cases, 8 in each of 7 categories. For each case the set holds the files and a record of what was generated: which runs are factory resets, which are SIM region changes, which entries sit on a 1970 clock, and how many wipes there are.

Categories in DS-0004 and the reference answer for each
Category	Cases	Setup	Reference answer	Wipes / region changes
No wipe	8	Ordinary recovery runs only (an update package and a locale). 1 to 5 entries per history.	0 factory resets, 0 region changes in every case.	0 / 0
One wipe	8	One confirmed factory reset, with 0 to 4 SIM region changes around it.	1 factory reset; the run code, requested time and the three formatted volumes.	8 / 13
Two wipes	8	Two confirmed factory resets, with 0 to 4 SIM region changes between and after.	2 factory resets, each with its own run code and requested time.	16 / 20
Region change only	8	1 to 4 SIM region changes, nothing else. Each is a run through recovery with no format lines.	0 factory resets; every entry is a region change with its from and to region.	0 / 20
Recovery clock reads 1970	8	Region changes, then 1 or 2 wipes, then more region changes. From the first wipe on, the recovery clock prints a 1970 date.	Wipe count, plus the true time of every later entry and how it can be estimated from the nearest earlier wipe.	12 / 29
Truncated history	8	The history file ends inside its last entry. Four cut points (inside the header, inside the command, after the command, before the closing line), each with a last entry that is a wipe or a region change.	Counts of entries a reader can classify, entries it cannot, and what the cut hides.	11 / 13
extra_history missing	8	A history that holds 1 to 3 wipes, with no extra_history file beside it.	Wipes counted from history alone; none confirmed by format lines.	14 / 7

The answers are in reference_answers.json (one record per case, one record per run) and reference_answers.csv (one row per run). They are kept out of the case folders so you can run a tool blind and compare after. Each run record gives the run code, the type that was generated and the type a reader can tell from the file, the recovery clock as printed, the true time, the requested time, the region change, the volumes formatted and the basis for the time.

Two limits. In the 1970 cases the gap between recovery clocks equals the gap between true times to within 2 seconds. LAB-0001 reports a phone where the two gaps disagreed by more than a year, and the set does not model that. A missing trace never proves a missing action: in the truncated and missing-file cases the answers say what the file hides.

One case, read end to end

Case c034-clock-1970-02: two region changes, two wipes and two more region changes. From the first wipe on, the recovery clock reads 1970. The run code ties each wipe to its format lines in the second file.

efs/recovery/history

+ [Zr | 2026/04/19 15:33:09 | SYNTH-FW-A] -
--just_exit
--reason=[SIMBasedChangeCSC] ATT -> VZW
NP -
+ [Tb | 2026/04/24 03:14:31 | SYNTH-FW-A] -
--just_exit
--reason=[SIMBasedChangeCSC] VZW -> USC
NP -
+ [ta | 1970/01/01 01:25:05 | SYNTH-FW-A] -
--wipe_data
--requested_time=1777085449
--reason=MasterClearConfirm
NP -
+ [fI | 1970/01/05 02:59:38 | SYNTH-FW-A] -
--wipe_data
--requested_time=1777436722
--reason=MasterClearConfirm
NP -
+ [Ia | 1970/01/08 11:34:38 | SYNTH-FW-A] -
--just_exit
--reason=[SIMBasedChangeCSC] USC -> XAA
NP -
+ [Bg | 1970/01/13 20:00:52 | SYNTH-FW-A] -
--just_exit
--reason=[SIMBasedChangeCSC] XAA -> USC
NP -

efs/recovery/extra_history

[ta][S] format_volume : /data
[ta][E] format_volume : /data
[ta][S] format_volume : /cache
[ta][E] format_volume : /cache
[ta][S] format_volume : /metadata
[ta][E] format_volume : /metadata
[fI][S] format_volume : /data
[fI][E] format_volume : /data
[fI][S] format_volume : /cache
[fI][E] format_volume : /cache
[fI][S] format_volume : /metadata
[fI][E] format_volume : /metadata

What the reference answer says about it

Reference answer for case c034-clock-1970-02, one row per run
Run code	Type	Clock as printed	True time (UTC)	Time basis
Zr	Region change (ATT to VZW)	2026/04/19 15:33:09	2026-04-19 15:33:09	recovery clock
Tb	Region change (VZW to USC)	2026/04/24 03:14:31	2026-04-24 03:14:31	recovery clock
ta	Factory reset	1970/01/01 01:25:05	2026-04-25 02:50:54	requested_time
fI	Factory reset	1970/01/05 02:59:38	2026-04-29 04:25:27	requested_time
Ia	Region change (USC to XAA)	1970/01/08 11:34:38	2026-05-02 13:00:27	estimate: nearest earlier wipe requested time plus recovery clock gap
Bg	Region change (XAA to USC)	1970/01/13 20:00:52	2026-05-07 21:26:41	estimate: nearest earlier wipe requested time plus recovery clock gap

Time basis requested_time means the true time is the request time in the file plus the lag from the request to the recovery entry. The set models that lag as 4 or 5 s. Here it is 5 s, so the two true times are 5 s later than the requested_time values in the file (02:50:49 and 04:25:22 UTC).

reference_answers.json (case flags and counts)

{
  "case_id": "c034-clock-1970-02",
  "flags": {
    "clock_reads_1970": true,
    "history_truncated": false,
    "extra_history_missing": false,
    "cache_copy_present": true
  },
  "counts": {
    "history_entries": 6,
    "factory_resets_readable": 2,
    "region_changes_readable": 4,
    "other_runs_readable": 0,
    "entries_not_classifiable": 0,
    "factory_resets_true": 2,
    "region_changes_true": 4
  }
}

The values are invented. The 1970 dates are what the set models from LAB-0001: a recovery clock that is wrong in absolute terms and right in elapsed terms.

Try the challenge: Read 56 synthetic recovery histories (Starter).

Get the dataset

One zip, 67,961 bytes. It holds 153 files: the cases, the reference answers, the licences, a short README and the generator. Check it against the hash below.

Download synthetic-recovery-1.0.zip (66 KB)

Served from this site, versioned. The manifest and the hashes are linked below.

SHA-256 of the zip

b16c56bfc44cac3bd75518c10facd58b11fdc9c0f123e6b9fa2075974d48ced6

The loose files, manifest.json and SHA256SUMS.txt sit beside the zip on this site. To rebuild every byte yourself, run python generate.py from the generator folder (Python 3, standard library only).

Licence

There is no acceptance step. Use the link above.

Data: Creative Commons Attribution 4.0 (CC BY 4.0)

A plain-language summary. The full text is at creativecommons.org/licenses/by/4.0 and in LICENCE.txt inside the zip.

You may

copy and share the files in any medium or format;
adapt them, for example to make test fixtures, and use them for any purpose, including teaching, research, casework and commercial work.

You must

give credit, using the citation on this page;
link to the licence and say if you changed the files.

Please also

keep the hashes beside any copy you share, so others can check it;
say that the files are synthetic. Do not present them as taken from a real phone or a real case. They are not.

Code: MIT

generate.py is under the MIT licence. Keep the copyright notice with copies.

The dataset is provided as is, without warranty.

Hashes

Check every file after download. The set hash is the SHA-256 of manifest.json, which lists the size and hash of every other file.

Set hash (SHA-256, manifest.json)

e78c22d28785411bb75c2840eaca00739b36ddffd65d214a8e93edf4b7c6d3e1

Files in DS-0004 with SHA-256 hashes
File	Content	Size	SHA-256
synthetic-recovery-1.0.zip	Archive	67,961 bytes	b16c56bfc44cac3bd75518c10facd58b11fdc9c0f123e6b9fa2075974d48ced6
reference_answers.json	Reference answers	167,753 bytes	a00b0a830a1fcdbc5f27d0059c19637dc9f6f1bfecc4a91e2cae123272de965d
reference_answers.csv	Reference answers (one row per run)	29,068 bytes	419a568379c8365799e1d2da491b0cb1776841f3efcdc50fb52bb83aac4e984e
README.txt	Notes	1,644 bytes	6a59f141a533024084a8ea639e1381559f51fc4c6c500b774a4b878fc4e37fcf
LICENCE.txt	Licences	1,435 bytes	b9f1189a7ecb6bf5ec38c63d180d678369b8a42c30fdc5542068acd84a9dcde9
generator/generate.py	Generator (MIT)	18,610 bytes	6323f8fa4c7f7c303abb3392f373f15be18d1b3cfc4f3804b6d66a3e07bd0b7d
manifest.json	Manifest (file, bytes, SHA-256)	28,336 bytes	e78c22d28785411bb75c2840eaca00739b36ddffd65d214a8e93edf4b7c6d3e1
SHA256SUMS.txt	The same hashes in sha256sum format	18,051 bytes	12f67368d2df8909b67a41e7b1ba0781bf75602e3148ae0019e9c75d7a46aad8
cases/ (148 files)	Histories, extra_history files and cache copies	31,103 bytes	One hash per file in manifest.json and SHA256SUMS.txt

The zip holds the same files as the folder (the zip itself, manifest.json and SHA256SUMS.txt excepted). Together the files are 249,613 bytes before compression. Hashes and sizes on this page are read from manifest.json.

Cite this dataset

Cite as

Addai, D., SectraTEK Lab (2026). Synthetic recovery-history set (DS-0004), version 1.0. SectraTEK Lab Datasets. https://lab.sectratek.com/datasets/synthetic-wipe-set/. SHA-256 of manifest.json e78c22d28785411bb75c2840eaca00739b36ddffd65d214a8e93edf4b7c6d3e1

Citation guide

BibTeX

@dataset{sectratek-lab-ds-0004,
  author    = {Addai, Daniel},
  title     = {Synthetic recovery-history set},
  year      = {2026},
  version   = {1.0},
  publisher = {SectraTEK Lab},
  url       = {https://lab.sectratek.com/datasets/synthetic-wipe-set/},
  note      = {DS-0004, SHA-256 of manifest.json e78c22d28785411bb75c2840eaca00739b36ddffd65d214a8e93edf4b7c6d3e1}
}

Datasets carry their own licence. This one is CC BY 4.0 for data and MIT for code. Articles are CC BY 4.0. All licences.