I am currently investigating the files of /data/system/usagestats/0/daily of an Android phone (version 6.0.1).
I have saved the daily files from the android phone with the adb pull-command every day, starting from the 05.08.18 up to 12.08.18.
As far as I know, the phone keeps the daily files for seven days.
In the picture, you can see the file from the 05.08. that I saved manually. Seven days later the file is still in the "daily"-folder but now has a different file name as you can see in the picture, whereas the content stayed the same.
To get the correct timestamp of each event, you have to add the number from last time active to the file's name. But in this case, you get a wrong result (difference of two seconds), because somehow the file's name updated.
Does anyone have any idea what is causing this time difference?
