#DFIR Android 13 is keeping track of when apps are launched and from where in the database “SimpleStorage” found in USERDATA/data/com.google.android.as/databases/. The table storing the info is “EchoAppLaunchMetrcisEvents” /1 
Columns of importance: timestampMillis, packageName, and launchLocationId. First two are self explanatory. The third provides what its name suggest: from where an app was launched. There are several numerical values in the column. /2
Observed values so far are:
1 - Home Screen
2 - Suggested Apps (bottom of Home Screen - New in Android 12)
4 - App Drawer
7 - Suggested Apps (top of App Drawer)
8 - Search (top of App Drawer or QuickSearchBox)
12 - Recent Apps/Multi-tasking
1000 - Notification
/3
1 - Home Screen
2 - Suggested Apps (bottom of Home Screen - New in Android 12)
4 - App Drawer
7 - Suggested Apps (top of App Drawer)
8 - Search (top of App Drawer or QuickSearchBox)
12 - Recent Apps/Multi-tasking
1000 - Notification
/3
Some quick SQL work can clean it up. Limitations:
1 - only keeps last 24 hours or so of data.
2 - no data is retained on deleted apps
3 - entries are triplicated
4 - possibly Pixel only (for now)
/END
1 - only keeps last 24 hours or so of data.
2 - no data is retained on deleted apps
3 - entries are triplicated
4 - possibly Pixel only (for now)
/END
• • •
Missing some Tweet in this thread? You can try to
force a refresh
