Where Android Records Who Used What: App Ops History in Databases, XML Files and Bug Reports

Android's App Ops service records which app used a protected resource, such as the camera, microphone or location, and when. On Android 16 the record exists in three forms: SQLite history databases, an XML file of last accesses, and a text dump in every bug report. Forensic writing covers mainly the XML file, and we found no description that relates the three, so their differences are unexplained. We derived what each form stores from the platform source, built a reader for the databases, and measured the forms on five Android 16 Samsung full file system images and five bug reports from four vendor families. The reader reproduced all 328,519 stored rows field by field. The forms record different moments: a database row holds the first event of a time window and a count, the XML file the last access. Only 54 percent of the XML times inside the database span equal a database time; a pre-registered test places 81 percent of the rest inside a window that counted more than one access, as the source predicts, and leaves 19 percent unexplained. A time from one form should therefore be matched to a window, not to an equal value.