After the Full Logical Acquisition or Custom Logical Acquisition of a device with Android OS 5.0 and higher, you will be able to view what actions were performed on the device at the certain moment of time.
To view the list of actions performed on the device:
- Acquire data from an Android OS device through the Full Logical Acquisition or Custom Logical Acquisition with the User Activity Timeline feature selected.
- In the Case Content pane or the Data View pane, navigate to the User Activity Timeline folder and click it.
- Click the User Activity Timeline grid.
- The list of actions is displayed in the Data Pane.
The list of actions grid consists of the following columns:
- Time: Date and time of the action.
- Application Name: Name of the application which was running on the device.
- Internal Application Name: Internal name of the application which was running on the device at the certain date and time.
- Internal Activity Name: Internal name of the activity performed on the device at the certain date and time, for example: com.android.launcher2.Launcher, com.samsung.sdm.ui.ActivationFail.
- Type: Event types representing the application state change, such as:
- Move to background (the user did not interact with the application at the certain time).
- Move to foreground (the user interacted with the application at the certain time).
- Configuration change (the device configuration was changed).
- None (it means that none of the above event types is applied to the application in question