In her presentation for the SANS DFIR Summit 2018, Jessica Hyde explains how the usagestats XML files record the following activity from Android devices:
- User interaction
- Move to foreground
- Move to background
- Configuration changes
I highly recommend the reader check out her Every Step you Take DFIR Summit video and presentation slides on PDF format. The rest of the blog post will make more sense after the viewing and/or reading of her work.
In order to leverage the data contained in these XML files I made a parser in Python 3 that takes the XML information and puts it in a SQLite database for ease of querying. The script can be found here:
https://github.com/abrignoni/Android-Usagestats-XML-ParserWarning:
The script has been tested and found to be accurate on my own data sets. Additional testing and validation of the script is humbly requested and more than welcomed.
Script usage
Extract from your source Android device the following directory:
\data\system\usagestats\
Export the usagestats directory |
Side by side as such. |
No arguments are needed. |
Data is served. |
Notice the fields. |
Usage_type:
Each XML file contains a description of what type of data is recording. The values can be event-log, configuration, and packages.
Lastime:
Records when an app (package) was last active or when a configuration took place. The XMLs themselves keep track of these time in two ways. Most usage events maintain a count of how many milliseconds have passed since the creation of the XML file and the occurrence of the event. To calculate the timestamp of the event the script takes the XML filename, which is the epoch time of the file itself in milliseconds, and adds to it the milliseconds the event took to occur. This provides the event time as en epoch timestamp. For events that are not millisecond offsets from the epoch time filename of the XML file, they keep the time as en epoch timestamp preceded by a minus sign. The script eliminates the minus sign to keep the epoch timestamp. My testing has shown this way of calculating times to be accurate to activity I have taken on the device.
The following image was included in an app review I did in November for the TikTok Android application. Notice the time some of the chat activity took place.
Notice the created time |
Notice the classs values |
Time_active
Certain events keep track of their length in milliseconds.
Package:
Application name.
Types:
Activity types as integer values. These represent activity like move to background or move to foreground. The list of interactions can be found here:
https://developer.android.com/reference/android/app/usage/UsageEvents.EventClasss:
Application name and corresponding modules in use.
Source:
Usagestat originating XML category. They are daily, weekly, monthly, and yearly.
Fullatt:
Contains the full attributes for the XML event, in other words all the data for the even in JSON format. With the data in this field the analyst can easily select any key:value pair and make it its own column in a SQL query by the use of JSON_Extract. For an example on how this SQL query function works see here:
https://abrignoni.blogspot.com/2018/09/finding-slack-messages-in-android-and.htmlSQL query
The following query can be run against the script generated database to format the timestamps from UTC to local time, add a field for time_active in seconds, and changes the types integer values to readable activity descriptions. Be aware that I have not added all case types per the link provided previously in the Types section. Add as needed.
SELECT
usage_type,
datetime(lastime/1000, 'UNIXEPOCH', 'localtime') as lasttimeactive,
timeactive as time_Active_in_msecs,
timeactive/1000 as timeactive_in_secs,
package,
CASE types
WHEN '1' THEN 'MOVE_TO_FOREGROUND'
WHEN '2' THEN 'MOVE_TO_BACKGROUND'
WHEN '5' THEN 'CONFIGURATION_CHANGE'
WHEN '7' THEN 'USER_INTERACTION'
WHEN '8' THEN 'SHORTCUT_INVOCATION'
ELSE types
END types,
classs,
source,
fullatt
FROM data
ORDER BY lasttimeactive DESC
Conclusion
My hope with this script is to make accessible the data contained in the usagestats xml files for digital forensic case work. Additional testing of the script and suggestions on how to optimize it are welcomed. I hope to create additional scripts that will parse the Android battery status and recent tasks XML files as show by Jessica Hyde in her presentation.
As always I can be reached on twitter @AlexisBrignoni and email 4n6[at]abrignoni[dot]com.