Time-anchor: Detecting system clock manipulation in android

Abstract

Timestamps generated in mobile environments primarily rely on the device system clock. However, their reliability can be compromised by user-initiated time changes, system errors, or time discrepancies between servers and devices. Analyses based on a single timestamp may therefore lead to errors in event timeline reconstruction. Nevertheless, a common standard for evaluating timestamps in mobile forensic analysis has not yet been established. This study examines the effects of system clock manipulation on timestamps recorded in Android artifacts and proposes a method for detecting time manipulation by comparing device time, generated from the device system clock, with external time, obtained from external servers. Experiments were conducted on four Android smartphones from two vendors, spanning Android 9 to 16, under three time conditions: normal, backdated, and postdated. Everyday activities, including calls, SMS, notes, voice recordings, messengers, emails, web browsing, and cloud storage were performed, and time information stored in application databases, file system metadata, logs, and notification history was analyzed. The results show that call logs, voice recording files, and web browsing records primarily reflected device time and shifted according to system time manipulation. In contrast, external time was preserved in some artifacts from SMS, notes, messengers, emails, and cloud services, enabling the detection of time manipulation and estimation of clock skew. These findings provide practical criteria for evaluating timestamp reliability in mobile forensic analysis and improve the accuracy of mobile timestamp interpretation.