What are application usage records?¶
Application usage records are system or app records showing when and how applications were active on the device.
What this means¶
They may include foreground use, background activity, screen time, launches, notifications, data use and battery consumption.
These records can help establish whether an app was active around a relevant event.
But the meaning varies.
Foreground use may show that the app was displayed.
Background activity may reflect synchronisation, notifications or automated processes.
Usage records may also be incomplete, reset by updates, affected by settings or stored only for a limited period.
The device may be shared, unlocked or remotely controlled.
Nor does it prove what the user did inside the application.
Time zones and clock settings also matter.
The evidence may support that the application was active or visible, rather than proving a particular communication or intention.
The operational takeaway is: usage records can help place an app in the device timeline, but they do not by themselves identify the user or the precise action. Corroborate them with app and account evidence.
What to check or do next¶
- Investigators should compare usage records with screen state, app databases, messages, provider logs and account sessions.
- Use cautious language.
Evidential limits¶
Screen-time totals may combine several short sessions and may not identify the exact action performed.
A record that the app was active does not prove who used it.