Could an app create records without the user opening it?¶

Yes. Operating-system and provider triggers can wake an app to synchronise accounts, receive content, update notifications or collect permitted data.

Identify the generating mechanism¶

A location point may follow background permission; a file may arrive through cloud sync; a status may change because another linked device used the account. These processes create timestamps and databases without visible screen interaction.

Preserve both value and limitation¶

Usage, notification and provider records can distinguish foreground, background and other-device activity. An automated artefact may still show account configuration, connectivity or service activity, but does not alone prove knowledge or intent.