01Location
- /data/system/packages.xml
02Questions it answers
- Which packages were installed when the file was written?
- Which installer is recorded for an app?
- When was a package last updated, and where is its code stored?
03Format and versions
| Format | XML written by the package manager (Settings.java). From Android 12, system files may be stored as ABX (Android Binary XML, signature "ABX\0"), which must be converted before reading; ALEAPP detects both forms. |
|---|---|
| Applies to | ALEAPP's notes cite AOSP Settings.java at android-10, -13 and -16. At android-13 and android-16 the package record carries ft and ut but no it; the first install time is written per user to package-restrictions.xml. |
04Key fields
| Field | What it tells you |
|---|---|
| package@name | Package name. |
| @codePath | Directory of the installed code. |
| @installer / @installOriginator | Installer package and originating installer as stored. |
| @ft | Last-modified time of the package code path; also printed as timeStamp in package dumps. |
| @it / @ut | Install time (older records) and update time. |
| @publicFlags / @privateFlags | Package flag bit masks as stored. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ft | Unix epoch, milliseconds (hex text in XML) | A file time of the installed code, not an install time; ALEAPP observed values in 1970 on some images. |
| it | Unix epoch, milliseconds (hex text in XML) | Absent from package records on Android 13 and 16 test images. |
| ut | Unix epoch, milliseconds (hex text in XML) | Update time as stored by the package manager. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Check the first bytes for the ABX signature and convert to text XML if present.
- Parse each package element and convert ft, it and ut from hexadecimal milliseconds to UTC.
- Separate system packages from user-installed ones using codePath and flags.
- Where install time matters, read the per-user package-restrictions.xml as well.
- Cross-check with usage stats and app data folders.
07Interpretation pitfalls
- Treat ft as code-file time; it is not evidence of when the user installed the app.
- The file reflects state at its last write; it does not by itself list apps that were installed and later removed.
- Attribute names and presence vary across releases; never infer a missing field's value.
09Sources
- ALEAPP — scripts/artifacts/packageInfo.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- Android ABX (Binary XML) Alex Caithness, CCL Solutions Group (2022) · checked 2026-10-14