ZEKASTRA case pack VP-10 - export metadata - SYNTHETIC TRAINING DATA
Device: Samsung Galaxy A55 5G, SIM 1 +905550127788. Device time zone Europe/Istanbul (UTC+3).
Window: 2026-09-27 00:00:00 to 2026-10-04 12:00:00 device local time (2026-09-26 21:00:00 to 2026-10-04 09:00:00 UTC).

Export 1: sms.csv
Source: the sms table of mmssms.db (telephony provider), from a logical extraction. Rows: 63.
date and date_sent: epoch milliseconds (UTC by definition). date_utc: the extraction tool's rendering of date, in UTC. For type 2 (sent) date_sent is 0.
type: 1 received, 2 sent.

Export 2: call-log.csv
Source: calllog.db from the same extraction, exported from the tool's Turkish-language report. Rows: 31.
date_local: DEVICE LOCAL TIME (UTC+3), written DD.MM.YYYY HH:MM:SS with no zone, because the report follows the device's time zone. duration_s in seconds.
type: 1 incoming, 2 outgoing, 3 missed, 5 rejected.

Export 3: usage-events.csv
Source: UsageStatsManager event records (usagestats), from the same extraction. Rows: 1328.
time_ms: epoch milliseconds (UTC). time_local: the tool's rendering of time_ms in device local time (UTC+3), no zone written.
event_type: 1 MOVE_TO_FOREGROUND, 2 MOVE_TO_BACKGROUND, 15 SCREEN_INTERACTIVE, 16 SCREEN_NON_INTERACTIVE, 17 KEYGUARD_SHOWN, 18 KEYGUARD_HIDDEN (the lock screen was dismissed: the device was unlocked).
The record shows that the device was unlocked; it does not say by PIN or by fingerprint, or by whom.

Export 4: Timeline.json
Source: Settings > Location > Timeline > Export, run on the device by the examiner on 2026-10-04 (acquisition-log.txt). Only rawSignals are present; semanticSegments was empty.
rawSignals[].position.timestamp: ISO 8601 WITH the device's offset, +03:00. Subtract three hours for UTC.
LatLng: "latitude°, longitude°" in decimal degrees. accuracyMeters: radius of the fix; source WIFI, GPS or CELL. A CELL fix can be a kilometre or more wide.
Positions: 1604. Activity records: 40.

Not in this pack
The victim's phone; the operator's records (CDR, cell sites); the messaging app's own database (bugle_db); WhatsApp; the contents of the gallery; the fingerprint sensor's logs.