Informative but Individually Unreliable: An Empirical Study of Android Reset Indicators and Their Clocks

Evidence of whether and when an Android device was reset lies in recovery logs, boot-reason properties and setup flags, each dated by its own clock, and descriptions of one or a few devices do not say how often these sources exist or how far their dates can be trusted. We read every reset-related source on 14 full file system extractions (12 Samsung; Android 10 to 16) and seven bug reports from four vendor families, classified the clock of each date, and tested a candidate rule that dates an undated recovery entry from a wipe's requested time. The Samsung recovery history was absent on all three units of one flagship generation, and on three older devices its header clock printed a constant, impossible year that passes a plausibility test. The boot-reason history never held a factory-reset entry, and the setup flags cycled around updates. The rule held on one phone, within 57 s of independent file times; on the only other phone able to test it, its central assumption failed by 526 days, a failure exposed by comparing two anchors. On these devices, reset indicators were informative but individually unreliable: each needs its own clock checked before a date is reported.