Authors: Jihye Jang, Eunji Lee, Yeon Baek, Jungho Kim, Sungjin Lee, Gibum Kim
DFRWS APAC 2026
Abstract
Timestamps generated in mobile environments rely on the device’s system clock. However, their reliability can be compromised by system errors, user-initiated time changes, or time discrepancies between servers and devices. Analyses based on a single timestamp may therefore lead to errors in event timeline reconstruction. Nevertheless, a common standard for evaluating timestamps in mobile forensic analysis has not yet been established. This study examines the effects of system clock manipulation on timestamps recorded in Android artifacts and proposes a method for identifying time manipulation by comparing device time, generated from the device system clock, with external time, obtained from external servers. Experiments were conducted on four Samsung Galaxy smartphones running Android 9 or later under three time conditions: unmodified, backdated, and forward-dated. Everyday activities, including calls, SMS, notes, voice recordings, messengers, emails, web browsing, andcloud drive usage,wereperformed,andtimeinformationstoredindatabases,filesystemmetadata, logs, and notification records was analyzed. The results show that call logs, voice recording files, and web browsing records primarily reflected device time and shifted according to system time manipulation. In contrast, external time was preserved in some artifacts from SMS, notes, messengers, emails, and cloud services, enabling the detection of time manipulation and estimation of clock skew. These findings provide practical criteria for evaluating timestamp reliability in forensic practice and improve the accuracy of mobile timestamp interpretation.