Most Ordinary Phones Trip a Naive Clock-Anomaly Check: Base Rates of Clock Anomalies in Unselected Mobile Extractions

Checks for clock manipulation on phones compare clocks or look for impossible times, and are tested on devices whose clock was changed on purpose. How often ordinary devices show the same signs, which sets the false-alarm rate, has not been reported. We pre-registered fifteen checks computed from the data, on file times in full file system extractions, the wall-clock and continuous-time pairs of the iOS unified log, and the clock state in Android bug reports, and applied them read-only to every readable extraction of a research corpus: 46 devices with full file systems, 31 iPhones with time-sync records and 7 Android bug reports. Simple checks fired on almost every device: a file time within a day of the Unix epoch on 41 of 46, a file dated over 48 h after acquisition on 16 of 46, a wall-clock step above 60 s within a boot on 23 of 31, and some file-system check on 45 of 46. Most file-system alarms are constant default times and future-dated cache files; most boot-order alarms are iPhones booting on an unset clock. A check against the build time never fired. At these base rates, a simple check's alarm barely changes the odds of manipulation.