01Location
- /data/system/usagestats/<userId>/{daily,weekly,monthly,yearly}/<begin-time-ms>
- /data/system_ce/<userId>/usagestats/{daily,weekly,monthly,yearly}/<begin-time-ms>
- …/usagestats/version and …/usagestats/mappings
02Questions it answers
- Which app activities moved to the foreground or background, and when?
- When did the screen become interactive and when was the keyguard hidden?
- When did the device shut down and start up?
- How much foreground or visible time did an app accumulate per interval?
03Format and versions
| Format | One file per interval, named with the interval's begin time. UsageStatsDatabase wrote XML before database version 4 and Protocol Buffers since; the current default version is 5, which uses obfuscated package tokens resolved through the mappings file. The version file holds the database version and a build fingerprint (release;codename;incremental). |
|---|---|
| Applies to | The storage folder moved from /data/system/usagestats to /data/system_ce/<userId>/usagestats depending on OS version. Event types such as ACTIVITY_RESUMED and DEVICE_SHUTDOWN are public from API 29, KEYGUARD_SHOWN/HIDDEN from API 28. |
04Key fields
| Field | What it tells you |
|---|---|
| event type | Numeric UsageEvents.Event constant, e.g. 1 ACTIVITY_RESUMED, 2 ACTIVITY_PAUSED, 23 ACTIVITY_STOPPED, 15/16 SCREEN_(NON_)INTERACTIVE, 17/18 KEYGUARD_SHOWN/HIDDEN, 26 DEVICE_SHUTDOWN, 27 DEVICE_STARTUP. |
| package / class | Package and activity class associated with the event. |
| packages aggregates | Per-interval totals such as last_time_active_ms, total_time_visible_ms and app launch count. |
| standbyBucket | App standby bucket; ALEAPP splits the stored value into bucket and reason (high/low 16 bits) as its own interpretation. |
| version file | Database version and build fingerprint written during upgrades. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| File name | Unix epoch, milliseconds | Begin time of the interval the file covers. |
| Event / package times | Milliseconds, offset from file begin time | ALEAPP adds each stored time to the file's numeric name to obtain an absolute UTC time. |
| DEVICE_SHUTDOWN | Event timestamp | Documented as the last time the database was persisted before shutdown, not the shutdown moment itself. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect the whole usagestats tree, including version and mappings.
- Identify the format (XML or protobuf) per file and decode package tokens through mappings where needed.
- Rebuild absolute times from the file-name base plus stored offsets.
- De-duplicate events that appear in more than one interval folder.
- Corroborate foreground events with app databases and the device's other logs.
07Interpretation pitfalls
- AOSP prunes old files: daily after 10 days, weekly after 4 weeks, monthly after 6 months, yearly after 2 years.
- Event names label platform transitions; SCREEN_INTERACTIVE is not a lock-state event and ACTIVITY_RESUMED does not by itself prove a person used the app.
- Open events between DEVICE_SHUTDOWN and DEVICE_STARTUP have unknown closing times and should not be extended.
09Sources
- AOSP — UsageStatsDatabase.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
- UsageEvents.Event — API reference Android Developers · checked 2026-10-14
- ALEAPP — scripts/artifacts/usagestats.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- ALEAPP — scripts/artifacts/usagestatsVersion.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14