Who Changed the Phone? When Acquirer-Induced Changes Can and Cannot Be Told Apart from the User’s Own

1 Introduction

An acquisition is an action on a device. It may restart the phone, switch on developer options and debugging, write settings, stage files and install and remove an agent [1]. Each step writes something, and the writes land in the stores a later reader consults to learn what the user did last. That reader, a second examiner, a reviewer or an expert for the other side, often has only the extraction and no notes. Two errors follow. The reader may take the acquirer’s changes for the user’s, or the acquirer’s changes may push the user’s earlier activity out of a store of bounded size.

A motivating example. A synthetic extraction (Table 1) shows developer options and USB debugging switched on by the Settings application half an hour before the end of the acquisition, a boot-counter step 50 minutes before, a write by the shell identity, and the temporary-files directory written 20 minutes before. Read as use, the first two records say the user prepared the phone for a computer. The model of this report labels them differently. Developer options were also switched on 300 hours earlier, so the record is shared between user and acquirer. USB debugging and the shell write have no earlier record with their signature, so they are forced to the acquirer under the support the older records teach. The boot step and the directory time are shared with the system. No record is the user’s by the data, and the data do not say which of the three shared records the user wrote.

The problem. Guidance asks examiners to document changes made by interacting with the device [1], and studies ask whether the user’s data survive acquisition [2, 3]. A companion measurement reports how often indicators of acquisition appear on ordinary devices and when [4]. What is missing is a statement of when the acquirer’s changes can be separated from the user’s by observation, with what error, and what observation can never settle. We ask four research questions.

• RQ1 (Conditions). When is the source of a record identified from the device alone, and what must be observable?
• RQ2 (Error). What error does separation by signature or by counting classes carry, and what does a shared cause do to it?
• RQ3 (Limits). Which quantities does observation never identify, and what does a controlled run add?
• RQ4 (Devices). How often do the conditions hold on real devices, and what does the Lab’s research corpus show?

Contributions. This report makes four contributions.

• An observation model of acquirer, system and user, with four statements about identification, shared causes, the missing control and bounded stores, each with a proof and an exhaustive or randomised check (Sections 3, 4 and 6.2).
• A separation procedure that is sound for the model, with a stated error and a report template that names what is unobservable (Section 5).
• An evaluation on synthetic histories and on 12 Android extractions and 7 bug reports of the Lab’s research corpus, including a contrast of the last start with earlier starts (Sections 6.3 and 6.4).
• The smallest controlled before-and-after design that identifies what observation cannot, with its sample size (Section 7).

Scope. The corpus data describe 12 admitted Android full file system extractions (nine on Android 16, ten from one vendor) and 7 Android bug reports; settings histories exist on 8 of them. The data do not record the steps of the acquisitions, so every statement about the acquirer is a statement about what the model allows. No controlled run was made. Section 9 states the limits.

2 Background and Related Work

2.1 Acquisition changes the device

The best-practice document of the Scientific Working Group on Digital Evidence says that extracting mobile device storage may require processes that leave digital artifacts and that documentation should include all changes made by interacting with the device [1]. NIST’s guidelines cover acquisition and examination procedures for mobile devices [5]. Carrier discussed the risks of live analysis [6], and Inoue and colleagues proposed visualisation for testing a volatile memory forensic tool [7] (we read the bibliographic records only). For Android, Vidas and colleagues described how preparing a device changes its state [3], and Geus and colleagues compared local-backup acquisition with the original storage on two phones, using a snapshot before and after each acquisition and repeated iterations to reduce noise [2]. A validation protocol for mobile workflows proposes repeated acquisitions under fixed conditions [8]. These studies ask whether the data survive or whether a method is reliable. We ask what the acquirer itself writes, and when a reader can tell.

2.2 Inferring who acted

James, Gladyshev and Zhu define the signature of a user action as the set of timestamps that the action updates, infer the action when the set appears within a short time, and remove background noise by repeating the action [9]. We use signatures in the other direction and add the epoch: the question is not what the user did but which records the acquirer can have written. Our signatures are coarser (store, key, writer class), and their support is learned from background records, with an error bound. In the other direction, a proof of concept for Android anti-forensics treats an enabled USB debugging as the discriminator between regular use and forensic analysis [10]. That is an identification claim of the kind Theorem 1 states, and it needs the debug state to lie in no other source’s support. LAB-TR-0031 found developer options and USB debugging on in all 14 Android extractions [4]; as all 14 are acquired devices, this shows the state is common after acquisition and cannot show whether it is rare without it (Theorem 3).

2.3 Identification

A parameter is identified when the distribution of the observables determines it [11]. The probability that an event was caused by an exposure is identified from data with and without the exposure under exogeneity and monotonicity, and only bounded otherwise [12]; Pearl gives the framework [13] and Manski the theory of partial identification [14]. A latent-class model with three or more conditionally independent binary indicators is identified in general [15], by a theorem of Kruskal [16]; Goodman treated identifiable and unidentifiable latent-structure models [17]. Non-decreasing events of independent variables are positively correlated (the Harris inequality [18]; Kleitman proved it for families of sets [19]). We use these results; none of them is new here.

2.4 Earlier Lab reports

LAB-TR-0031 defines six footprint classes, a rule that fires when two classes appear in the 24 hours before the end, and base rates on the same devices [4]. This report reuses its classes, its frame and its per-device indicators and does not repeat its results. Reset indicators and their clocks are the subject of LAB-TR-0004 [20], security-setting states of LAB-TR-0019 [21], retention horizons of LAB-TR-0021 [22] (the bounded and volatile stores of Section 3.3 are instances of a horizon), clock base rates of LAB-TR-0022 [23] (they bear on δ), answerability of LAB-TR-0029 [24] and the semantics of absence claims of LAB-TR-0034 [25] (whose unobservability reasons the stores of Section 3.3 add to).

2.5 Position of this work

We searched for earlier work that states conditions for separating acquirer-induced changes from the user’s by observation, or that measures the effect of a shared cause on a class-count rule, and found none (queries and dates are in the Lab’s private notes). The statistical tools are standard. New here are the signature-and-epoch model for acquisition footprints, the statements about shared causes and the missing control, the contrast of the last start with earlier starts on 8 histories, and the minimal design. The corpus counts replicate or extend those of LAB-TR-0031 and are marked where they repeat it. The checker and simulations are engineering.

3 Observation Model

3.1 Sources, signatures and the epoch

A device has three sources of records: the user (U), the system (S) and the acquirer (A). A record is a pair r = (σ, t̂) of a signature σ and a reported time. A signature names the store, the key class and the class of the writer, for example (a settings key, the Settings application). A model M = (Σ_U, Σ_S, Σ_A) lists the signatures each source can write. T is the end of the acquisition and the epoch is E = [T − L, T], with L = 24 hours as in LAB-TR-0031. We assume:

• A1 (epoch). The acquirer writes only inside E.
• A2 (independent records). That a source writes one record places no condition on other records.
• A3 (clock). A reported time differs from the true time by at most δ.
• A4 (anchor). T is known from outside the device. If it is known only within δ_T, δ in Definition 1 is replaced by δ + δ_T.
• A5 (stores). A store keeps records subject to a stated capacity or horizon.

Definition 1 (candidate sources). For a record r = (σ, t̂), C(r) is the set of sources s such that σ ∈ Σ_s and, for s = A, T − L − δ ≤ t̂ ≤ T + δ.

Definition 2 (labels). A record is acquirer-forced if C(r) = {A}; not acquirer if A ∉ C(r) ≠ ∅; shared if A ∈ C(r) and |C(r)| ≥ 2; unexplained if C(r) = ∅, which falsifies the model.

3.2 Classes and shared causes

The six classes of LAB-TR-0031 are observed per epoch. Let Z = 1 mean that an acquisition took place in the epoch. Three kinds of start can occur: an ordinary restart Ro with probability ρ; an acquirer-induced start Ra with probability κZ; and a special start Q with another cause and probability e. A special start S is Ra or Q; the restart indicator R is 1 if any start occurs. Given these variables the classes are independent and combine by noisy-OR, a causal-independence model [26]:

P(X_c = 1) = 1 − (1 − b_c)(1 − a_cZ)(1 − r^o_cRo)(1 − r^s_cS),

with background probability b_c, direct acquirer effect a_c and restart effects r^o_c and r^s_c. A class is direct if only a_c is non-zero, mediated if a_c = 0 and the last two factors are replaced by the single factor (1 − r_cR), so that the class depends on the world through R alone, and a marker if only r^s_c is non-zero. The restart class is R itself. Figure 1 shows the structure. The model is a hypothesis, not a measurement: the corpus does not say which start was which.

3.3 Stores

Two store types matter. A bounded history keeps the N most recent records per key; in the settings histories we read, the maximum is five. A volatile store is emptied by a restart, so after uptime u it holds at most u hours.

4 What Observation Can and Cannot Identify

4.1 Records

Theorem 1 (record-level identification). Under A1 to A4: (a) C(r) is exactly the set of sources that can have written r: for each s in it some world consistent with the observation has s write r, and for no source outside it does any such world exist. (b) Hence r is acquirer-forced iff σ ∈ Σ_A ∖ (Σ_U ∪ Σ_S) and the time lies in [T − L − δ, T + δ]; no sound rule that uses only signature and reported time labels more records forced than Definition 2. (c) If Σ_U ∪ Σ_S is replaced by the signatures seen in n independent background records, the expected number of falsely forced background records among N_b background records in the labelling window is at most N_b|Σ_A|/(exp(1) n), where exp(1) = 2.718… is Euler’s number (not the rate e of Section 3.2).

Proof. (a) By A2 a source can write r whenever the signature is in its support, and by A1 and A3 the acquirer can have written it iff some true time within δ of t̂ lies in E. (b) follows from (a). (c) A background record is falsely forced iff its signature σ ∈ Σ_A was unseen in the n records, which has probability Σ_σ p_σ(1 − p_σ)ⁿ. Each term is at most p exp(−np) ≤ 1/(exp(1) n). □

Corollary 1 (what must be observable). A record can be identified as written by the acquirer only if (i) its store retains it (capacity and horizon, A5); (ii) its writer or another distinguishing field is recorded; (iii) T is known from outside, and a record is excluded as acquirer-written by its time only if it lies more than δ before the epoch; and (iv) the support of the other sources is documented or learned from at least N_b|Σ_A|/(exp(1) ε) background records, which holds the expected number of falsely forced records below ε. Condition (iv) fails for a signature whose store keeps one time only, such as a directory time.

4.2 Classes that share a cause

Theorem 2 (shared causes). In the model of Section 3.2: (a) for every set G of classes and each value of Z, P(all classes of G observed) ≥ Π_c∈G P(X_c = 1). (b) So the calculation that treats the classes as independent never exceeds the exact false-alarm probability of the rule “all classes of G observed”. For the rule “at least k of m” the sign is not determined. (c) If a class depends on the world only through R, then P(Z = 1 | X_c, R) = P(Z = 1 | R) for every prior: counting it next to R adds no evidence about Z.

Proof. (a) For a fixed value of Z each X_c is a non-decreasing function of independent Bernoulli inputs (Ro, Ra, Q and one private input per class). Non-decreasing events of independent inputs are positively correlated [18, 19], and the product bound follows by induction. (b) is (a) for the conjunction; for “at least k” the event is a union of conjunctions, whose correlation can move the probability either way (Table 3 gives the range). (c) A mediated class is f(R, ξ) with ξ private; hence it is independent of Z given R. □

4.3 The missing control

Theorem 3 (no variation, no identification). Let P(S = 1 | Z = z) = 1 − (1 − e)(1 − κz). (a) If every observed epoch has Z = 1, the distribution of all observables depends on (κ, e) only through P₁ = 1 − (1 − e)(1 − κ); likewise for each class only through 1 − (1 − b_c)(1 − a_c). So all pairs on that curve are observationally equivalent, and the share of special starts caused by the acquisition, PN = (P₁ − e)/P₁, is known only to lie in [0, 1]. (b) If epochs with Z = 0 are available and Z is exogenous, e = P₀, κ = (P₁ − P₀)/(1 − P₀) and PN = (P₁ − P₀)/P₁. (c) Earlier starts can stand in for the control only if they are exchangeable with the control; this can be checked for observables, not for the cause.

Proof. (a) The joint distribution given Z = 1 is a function of the law of S given Z = 1, which is Bernoulli(P₁), and of the other inputs, which do not involve (κ, e) separately. The map (κ, e) ↦ P₁ is many-to-one, with image of PN from 1 (e = 0) to 0 (e = P₁). (b) is Theorem 4 of Tian and Pearl, with monotonicity because κ ≥ 0 [12]. □

4.4 Bounded and volatile stores

Proposition 4 (displacement). A store keeps the N most recent records of a key. If m₀ = min(N, number of earlier records) are retained and the acquirer writes n_A more, the number of earlier records lost is min(m₀, max(0, m₀ + n_A − N)). A full key shows nothing older than its oldest retained record, so “no earlier change” is supported only back to that record.

Proposition 5 (volatile stores). A store emptied by a restart shows at most min(1, u/L) of the epoch after uptime u. A restart caused by the acquirer therefore removes the rest of the epoch from that store whatever else was written.

Proof. Proposition 4 is a counting argument for a first-in, first-out store, checked exhaustively for small cases (Table 3); Proposition 5 restates the definition of a volatile store. □

5 A Separation Procedure

The procedure applies Definitions 1 and 2 to every record of the epoch and reports what the labels cannot say.

1. Fix the frame. Take T from outside the device, L and δ, and the last start from at least two boot sources.
2. List the epoch records by store, with signature and reported time.
3. Set the supports. Declare Σ_A from documentation. Learn Σ_U ∪ Σ_S from records older than a cut (here 72 hours); treat a signature whose store keeps no history as shared.
4. Label and bound. Label each record by Definition 2. Compute the bound of Theorem 1(c) for the forced labels.
5. Report the unobservable. Name the stores whose horizon or uptime does not cover the epoch, the keys at capacity, and every restart-linked marker whose source is unidentified.

Theorem 4 (soundness). If the model holds, every label the procedure gives is implied by the observation, and an acquirer-forced record certifies Z = 1. If it fails only through unseen background signatures, the expected number of wrong forced labels is bounded by Theorem 1(c). The procedure never labels a record as the user’s act: the user is a candidate, not a conclusion, unless C(r) = {U}.

Proof. The labels are functions of C(r), which Theorem 1(a) shows exact; a forced record has only A as candidate, so some acquirer write occurred. The second sentence is Theorem 1(c). □

6 Evaluation

6.1 Design

Three kinds of evidence test three kinds of claim. Exhaustive and randomised checks test the algebra of Section 4. Synthetic worlds drawn from the model test the operating characteristics of rules and of the procedure under controlled values of the quantities that observation cannot fix; they confirm code and algebra, not realism. The research corpus shows how often the conditions hold on real devices. Its frame is that of LAB-TR-0031 [4]: every readable Android full file system extraction (14) and every Android bug report (7), of which 12 extractions are admitted because the acquisition end T can be trusted, and 8 carry settings histories. The new reading takes the time, store kind and writer class of every record in the three settings histories, and the retained boot-counter steps (a start is a retained step of the boot counter in the global settings history, and the last start is the newest one before T; each key keeps at most five); key names, values, package names and call stacks are not written to any result. Synthetic presets are chosen to resemble the aggregates of LAB-TR-0031 and carry no device value.

6.2 Exact checks

Table 3 shows that each statement holds on the instances checked. They confirm the proofs on small and random cases; they are not proofs for all sizes.

6.3 Synthetic worlds

Rules. Table 4 evaluates five rules exactly on the reference preset. The class-count rule of LAB-TR-0031 (R0) has a false-alarm probability of 0.233 when no special start of another cause exists, against 0.130 by the independence calculation; the restart and boot-reason pair alone raises an alarm with probability 0.214, not 0.084. Counting evidence groups (R1: restart, boot reason and marker as one group) lowers it to 0.042; its range over directory-write rates from 0.02 to 0.40 is 0.010 to 0.159. The marker alone (R2) never raises a false alarm until another cause of special starts exists; at a rate of 0.2 it raises one with probability 0.175. The class rules R0, R1 and R3 have power 0.97 to 0.98 and the marker rules R2 and R4 0.77 to 0.79, because the marker follows the acquirer’s start with probability 0.79. The choice is therefore mostly a choice of false alarm, and the unidentified rate e moves some rules and not others (Figure 2).

Records. Table 5 applies the procedure to synthetic histories with nine acquirer-capable signatures. At capacity 5 and full overlap with a background writer (ω = 1) the procedure labels 0.18 of the acquirer’s retained records forced and 0.82 shared; precision of the forced label is 0.933. At capacity 1 every record is forced, because a key then holds nothing older: the false-forced rate rises to 1.00 per background record in the epoch. Capacity decides how much separation the bound of Theorem 1(c) buys. A background writer on the same signature costs mostly recall (forced share 0.80 at ω = 0.25, 0.18 at ω = 1) and some precision (0.997 and 0.933). The acquirer also displaces earlier records, 3.8 per device at capacity 5 and full overlap, which a reader cannot see. With a reported-time error of 10 minutes, 0.0045 background records per device enter the epoch from the boundary band; with 60 minutes, 0.022.

6.4 Research devices

Conditions. Table 6 gives the conditions of Corollary 1. The anchor and the restart order are well supported. Three conditions are weak: the background sample is small (36 records older than 72 hours on the five debug keys over 8 devices, none on the shell identity), 281 of 493 keys with an epoch record are at capacity, and volatile stores see a median 15.6% of the epoch because the median uptime is under four hours. The system log of a bug report covers a median 4.2% of it when counted from the start of its body; the oldest line, a stray older than the body in four of the seven reports, would give 31.2%.

Labels. Table 7 labels the 1,024 epoch records of the 8 histories. Under the documented support 73 records are forced to the acquirer: the 36 writes by the shell identity and 37 of the 46 debug-key changes. 9 are shared. The remaining 942 records, written mostly by the platform or other components, lie outside Σ_A, so the acquirer is not a candidate for them; we do not enumerate the supports of the other sources and give them no further label. The count of forced records depends on the signature: with the writer class alone 39 are forced and 43 shared; with a 24-hour cut 65 and 17. The bound of Theorem 1(c) depends on the number of signatures in Σ_A. Counted as six (the five keys, and the shell identity as one), with every epoch record as N_b and the older records of each device as the sample, it gives at most 1.1 falsely forced records in all, if the background is stationary. At the granularity of Table 7 (key and writer) the five keys alone hold 25 signatures and the bound is 4.6, before the shell identity on other keys is added; a worst-case bound of that size does not settle how many of the 73 are the acquirer’s. The labels depend on the support assumed; they are not a count of acquirer writes.

The last start and earlier starts. The shell identity wrote within 30 minutes after the last start on 7 of 8 histories and within 120 minutes on 8 of 8. Of the 23 earlier starts older than 72 hours it wrote after none, within either window (Table 8, Figure 3; Fisher’s exact test of the 30-minute contrast gives p = 3.0×10⁻⁶ if starts were independent; they are not, since they cluster in 8 devices, so we read p as an index of the contrast). The four keys the shell identity wrote at the last start keep their records back to the first change of the key or, when full, at least 129 days, and the 23 older starts are all less than 85 days old, so displacement (Proposition 4) does not hide a shell write after any of them. The 2 of 9 earlier starts within 72 hours that a shell write followed fall 1 and 58 minutes before the last start of their device. Counting writes within 30 minutes before or after a start reproduces the 9 of 40 of LAB-TR-0031. Debug keys changed within 24 hours after the last start on 6 of 8 histories and after 2 of the 23 older starts (0 of the 16 whose keys are not at capacity). Between earlier retained starts there are 24 intervals of median 52.4 hours, 8 of 24 shorter than 24 hours: a restart in a random day has median probability 0.39 on these devices, so ordinary restarts are common. The shell write is a marker of a kind of start that the last start usually was and the ordinary starts were not.

If the starts were exchangeable apart from acquisition, the lower bound for the share of the marker’s presence caused by the acquisition would be (0.53 − 0.14)/0.53 = 0.73, from the Wilson limits of the two proportions, a conservative combination of two 95% limits (Theorem 3(b)). That bound rests on exchangeability, which the data cannot test: the last start is, by construction, the one nearest T. The special start may have been caused by the acquirer, by an update, a reset or a preparation of the device; the corpus holds nothing that tells these apart.

Rules on the devices. The class-count rule, as in LAB-TR-0031, fires on 11 of 12 extractions. Counting the restart, boot-reason and shell classes as one group it fires on 11 of 12. If the directory write, which is a single time per directory and has no history, is also counted with the restart, it fires on 7 of 12. The groups per extraction are 0, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3.

7 What a Controlled Before-and-After Run Would Add

Theorem 3 says which quantities the corpus cannot give. Table 9 lists them with the run that supplies each. The central one is the share of the restart-linked marker caused by the acquisition. It needs two kinds of epoch on one test device: acquisition runs, and control restarts without acquisition. With eight runs per arm, the exact test separates a marker that follows 90% of acquisitions from a control rate of 0.10 with power 0.93 and from a rate of 0.02 with power 0.99; with six per arm the powers are 0.66 and 0.84 (Figure 4). The error of the estimate of the share caused is a root-mean-square of 0.126 at eight runs per arm and control rate 0.10, with a bias of −0.002.

Could the corpus do without a control? A latent-class model with three conditionally independent direct classes is identified from unlabelled epochs in general [15]. On synthetic windows with a share of 0.2 acquisition epochs, the median error of the estimated detection probabilities is 0.26 for 12 windows, 0.07 for 200 and 0.04 for 1,000 (38% of runs err by more than 0.15 at 50 windows). The corpus holds 12 epochs, and its classes are not conditionally independent (Theorem 2). A control run of 16 acquisitions and restarts is cheaper by more than an order of magnitude than 1,000 windows, and it identifies the cause, not only the rates.

8 Discussion

What a report may say. Of a record in the epoch a report can say that it was acquirer-forced, shared or outside the support, give the support and the cut, and name the stores that could not show the epoch. It should not say that a change was the user’s because no tool marked it as the examiner’s. A restart-linked marker may be reported as such, with its source unidentified.

The cost of a class count. The rule of LAB-TR-0031 counts a restart, a boot-reason entry and a shell write as three classes; they follow one event. Counting groups lowers the false-alarm probability by a factor of about 5.5 on the reference preset and leaves the number of extractions that fire at 11 of 12; the dependence on the unmeasured directory class is larger (7 of 12). A rule is a statement about a model, and the model should be stated.

Hidden activity. Displacement and volatile truncation can hide the user’s earlier activity. A median of 15.6% of the epoch is visible in volatile stores on these devices, and 75% of epoch records sit in keys at capacity. These effects follow from the design of the stores; a restart is enough.

Implications for tests. Validation of mobile workflows by repeated acquisitions [8] can include the control restarts of Table 9 at small cost.

9 Threats to Validity and Limitations

Construct. The model equates the acquirer with what happens in a 24-hour epoch before T (A1). A device prepared earlier, or acquired in several sessions, violates it, and an action the user takes because the acquirer asked is acquirer-induced in the counterfactual sense and user-written by the record; signatures cannot tell the two apart. A2 fails for bundles such as four settings written together; the procedure then loses information but stays sound. The documented support Σ_A is taken from LAB-TR-0031, not from a controlled run.

Internal. The background support is learned from at most five records per key and assumed stationary; the bound of Theorem 1(c) is a worst case under that assumption. The restart-aligned windows count only starts whose key histories cover the window where stated. T comes from extraction metadata on 11 of 12 extractions and the boot sources are written by one system. Hours before T are computed in the archive’s UTC fields.

External. Twelve extractions, eight histories, all eight of one vendor and one release; the bug reports (seven sources) are used only for volatile-store coverage. Results for other vendors, other releases and other acquisition methods may differ. Counts are small, so proportions carry Wilson intervals and no inference beyond these devices is claimed.

Synthetic worlds. They are generated from the model that the proofs assume, so agreement tests the code and the algebra. The presets resemble the aggregates of LAB-TR-0031 and are not fitted.

Limitations. No controlled run was made, so no parameter of the acquirer is measured: not the signatures it writes, nor how often, nor the share of the special start it caused. The corpus holds no record of the steps taken. The statements about the last start are statements about a kind of start.

10 Conclusion and Future Work

Observation can separate the acquirer’s records from the user’s only where their signatures differ, and the error of doing so is bounded by how much background the reader has seen. A rule that counts classes with a shared cause misstates its own error, and no number of acquired devices says how much of a restart-linked marker the acquirer caused: that needs a control restart. On eight Android settings histories the shell identity marked the last start and no ordinary start, and the source of that start stays open. Next, a controlled run on a Lab test device following Table 9; a second vendor to test whether the marker is specific; and a version of the model with interval times for the clock error δ.