Worksheet: what does each evidence source keep?
================================================

Pick a pair. Work from its ffs/ folder first, then from its bugreport/ folder only, then compare.
Answers: reference_answers.json (open it after you have written yours).

A. From ffs/ only
 1. How many entries are in efs/recovery/history? Which are factory resets (--wipe_data with
    --reason=MasterClearConfirm) and which are SIM region changes (--just_exit with [SIMBasedChangeCSC])?
 2. For each factory reset, which three volumes does extra_history show formatted under the same run code?
 3. What does --requested_time= give for each reset (epoch seconds, UTC)? Convert it.
 4. Does the recovery clock in the header agree with the requested times? Do any headers read 1970?
 5. If the clock reads 1970, give each region change an estimated time: the requested time of the nearest
    earlier reset plus the clock gap. Then check that rule: does the gap between the clocks of two resets
    equal the gap between their requested times (within 2 seconds)?
 6. Which files in cache/recovery exist? Which run does each last_log belong to? (They carry no run code.)
 7. What does mps_code.dat say, and does it match the last region change?
 8. What is the modification time of data/misc/bootstat/factory_reset?

B. From bugreport/ only
 9. What is the dumpstate time? Read it from the header.
10. What does SYSTEM PROPERTIES say about the region (ro.csc.sales_code)?
11. Read persist.sys.boot.reason.history. Which boots survive? Is a reboot,factory_reset entry among them?
12. Use the uptime line to work out the time of the last boot.
13. Read dumpsys user (Created) and dumpsys package (firstInstallTime of the system packages). What do they
    say about the last reset, and about earlier ones?
14. Is there an FS/cache/recovery folder? If so, which run does it copy?

C. Compare
15. How many resets does each source show? Which source can see the first reset? Which can see the last?
16. Which region changes can the bug report show, and how directly?
17. Where do the two sources give the same time for the last reset, and by how much do they differ?
18. Write one sentence per source: what a missing trace would and would not prove.
