An Android phone, a threatening SMS and an alibi: SMS, call log, usage events and location history

01Brief

On 3 October 2026 at 23:47 local time a woman in Abbasaga, Besiktas received the SMS 'Bu iş burada bitmedi. Şu an neredesin biliyorum.' from +905550127788. The number belongs to a man she knows. He says he had dinner with a friend, Ece, in Uskudar, left his phone at her house when he went out at about 21:30 and picked it up the next morning. His Samsung Galaxy A55 was seized at 11:40 on 4 October. A logical extraction gave the SMS table, the call log and the usage events; the examiner exported the on-device location Timeline with the PIN the owner gave in his lawyer's presence. The device's time zone is Europe/Istanbul (UTC+3).

Internal audit asks:

1. Was the message sent from this phone, and when, in UTC?
2. Where was the phone when it was sent, and how precisely can that be said?
3. Do the records support the owner's account of the evening?

Answer from the files only. Speak about the phone and its records; who held the phone is not shown by them. The victim's phone, the operator's records and the messaging app's own database were not examined.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Convert every time to UTC before comparing two sources: the SMS table is epoch, the call log is local, the Timeline carries +03:00.
• A fix is a circle: give the radius with every location you report.
• Report the phone, not the person.

Keep your notes in F-02 Evidence intake form and F-04 Examination log and F-03 Acquisition record.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 30 points.

1. Q011 pointsms.csvmanifest.txt

   On a copy of sms.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.8 hex characters
   Check

2. Q022 pointssms.csv

   When was the message 'Bu iş burada bitmedi…' written to the phone's SMS table as sent? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

3. Q032 pointssms.csv

   How many messages did the phone send to +905550193344 in the export window?Whole number
   Check

4. Q042 pointscall-log.csvsms.csvexport-metadata.txt

   The call log shows an outgoing call to 'Ece' at 03.10.2026 23:41:12. How does it stand against the message?

   AThree hours after it: 23:41 is later than 20:47.BSix minutes and nineteen seconds before it: the call log is device local time, 20:41:12 UTC, and the message is 20:47:31 UTC.CAt the same moment: both are the phone's clock.DIt cannot be placed: the report gives no zone.
   Check

5. Q052 pointscall-log.csv

   When did that outgoing call to Ece start? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

6. Q061 pointcall-log.csv

   How long did that call last, in seconds?Whole number
   Check

7. Q072 pointsTimeline.jsonacquisition-log.txt

   When did the location history first place the phone within 200 m of the complainant's building, counting only fixes with an accuracy of 100 m or better? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

8. Q082 pointsTimeline.json

   At 23:30:07 local one fix has source CELL, accuracy 1,500 m, and a centre about 870 m from the building. What does it show?

   AThat the phone left the building for a while.BNothing that contradicts the Wi-Fi and GPS fixes around it: the building lies well inside its 1,500 m circle.CThat the record was tampered with.DThat the phone was at the owner's home.
   Check

9. Q092 pointsTimeline.json

   How many fixes with accuracy ≤100 m fall within 200 m of the building between 23:00 and 00:00 local time on 3 October?Whole number
   Check

10. Q102 pointsusage-events.csvexport-metadata.txt

    At 20:46:51 UTC the usage events record KEYGUARD_HIDDEN, then Messages to the foreground at 20:46:58 and to the background at 20:47:40. What can be said?

    AThe owner unlocked the phone with his fingerprint.BThe message could have been sent by an app in the background without anyone touching the phone.CThe lock screen was dismissed and Messages was in the foreground when the sent row was written at 20:47:31: the phone was unlocked and in use. By whom, and by PIN or fingerprint, is not recorded.DNothing: usage events are statistics, not events.
    Check

11. Q112 pointsusage-events.csv

    Which package was in the foreground when the SMS row was written?Package name
    Check

12. Q122 pointsusage-events.csv

    How many times was the lock screen dismissed (KEYGUARD_HIDDEN) between 23:00 and 00:00 local time on 3 October?Whole number
    Check

13. Q132 pointsexport-metadata.txtdevice-info.txt

    Which statement about the time bases is right?

    AEverything is local time because the device is set to Europe/Istanbul.BEpoch values (sms date, usage time_ms) are UTC; the call log report is device local; Timeline times carry +03:00; the device clock was 2 s ahead at seizure.CEverything is UTC because Android stores UTC.DThe Timeline is UTC; the +03:00 is the examiner's computer.
    Check

14. Q142 pointsTimeline.jsonacquisition-log.txt

    When did the location history first place the phone within 150 m of the owner's home after it left the building? UTC, fixes with accuracy ≤100 m.YYYY-MM-DD HH:MM:SS, UTC
    Check

15. Q152 pointsTimeline.jsoncall-log.csvusage-events.csvacquisition-log.txt

    The owner says he left the phone at Ece's in Uskudar at about 21:30 and collected it the next morning. What do the records show?

    AThey confirm it: the phone was at Ece's building until 22:24 local.BThey contradict the second half: the phone left Ece's building at 22:24 local, was near the complainant's building from 22:51 to 23:58, was unlocked five times there, called Ece's number, sent the message, and went to the owner's home at 00:36; it was never back at Ece's before the seizure.CThey prove the owner sent the message.DThey say nothing, because location history can be edited.
    Check

16. Q162 pointssms.csvTimeline.jsonusage-events.csv

    Which sentence can the examiner sign?

    AThe suspect sent the threat from outside the complainant's door.BThe phone +905550127788 recorded as sent, at 20:47:31 UTC on 3 October, the message to +905550193344; at that minute it was unlocked with Google Messages in the foreground, and its location history places it 47 m from the complainant's building (radius 20 m). The records do not show who was holding it.CThe message was sent at 20:47, before the owner left dinner.DThe phone was in Besiktas, so the owner lied.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis; epoch, local and offset times are each converted correctly.
• Every location is given with its accuracy radius, and wide fixes are not read as points.
• The use of the phone (unlocks, foreground app) is placed around the message on one UTC line.
• The owner's statement is tested part by part.
• The report speaks of the phone, not the person, and lists what was not examined.

How findings are phrased →