Android Usagestats used to be an artifact that wasn’t parsed by commercial forensic tools, but thanks to the work that is being done in the research community, we have seen that it is now an artifact that gets much deserved focus and is now part of “Analyzed Evidence” or “Artifacts”. This area of research was tackled early on by former student and forensic examiner/researcher, Alexis Brignoni in his Android-Usagestats-XML-Protobuf parser. This stand-alone tool has also been incorporated into his Android Log Events parser, ALEAPP.

GitHub - abrignoni/ALEAPP: Android Logs Events And Protobuf Parser.

The activity was stored in .xml format up through Android Pie (9.x), and in later firmware, (10+), it is now stored as a Protobuf. ¹

One thing you may notice when looking at the Usagestats files in both Oxygen (left) and Cellebrite (right) is that the timestamps don’t appear to be in a recognized format. In his script, Alexis accounts for these timestamps. The Android-Usagestats-XML-Protobuf parser is available in GitHub: GitHub - abrignoni/Android-Usagestats-XML-Protobuf: Android Usagestats XML + Protobuf Parser, and there is a post specific to his research on Android Usagestats, as well as many other topics, maintained on his personal blog: https://abrignoni.blogspot.com.

Reference:

https://github.com/abrignoni/Android-Usagestats-XML-Protobuf