0

My phone's SD card got stolen yesterday, and I'm trying to find a way to read the boot up logs. I had left it at work by accident, and I know that it had to have been stolen by one of our employees in the 8 hour window it was there. Now, I pretty much have my suspicion of who took it, but I need a definite point of evidence I can show my boss before I start asking to check our camera files (pointed outside of the breakroom, not actually one in it to certifiably catch anyone). So, seeing as my phone was on and charging the whole time I left it, that someone would have to take my battery out to take the SD card, and that the phone was already booted up when I came back and picked it up--I figure this is my way to tell exactly who it was by tracking back to that time in the room and seeing who exactly was there.

I can't control what this person does with my SD card or the info on it, but I don't care too much seeing as I have nothing to hide. I'm just really pissed because I had a lot of family pictures and pictures of my late dog on there, and I want to pin the person for stealing my crap, tell them to return my card or get me a new one, and get them out of here.

Also, this is unrelated to the boot files, but I connected my phone to my laptop and it shows some Android data folders were edited at a time when I wasn't with the phone yesterday (com.android.vending and com.google.android.youtube, which has a recently edited cache). I'm guessing this either has to do with an automatic update or someone using my phone...I can't see any files in the folder, only when they were last edited. If there's a way you can help me understand what's going on with this and to differentiate what happened, I would also appreciate it.

Thank you!

Improve this question
1

1 Answer 1

Reset to default
1

Unfortunately for you, the Android log files use a "ring buffer" (think of it as an Ouroboros), so you might not be able to see the startup logs anymore. But here are some things you can do:

  • Check the "battery monitor" in Settings. Provided you didn't put your device to charge again since, it should show you how long it's been running without being attached to a charger
  • Using a terminal app or adb shell, run the command uptime – which tells you exactly how long the device has been running since it was last powered up (should also be listed in Settings › About › Status on your device)
  • different logs can be obtained via logcat, dmesg, and others (see our logging tag-wiki). On ICS (Android 4.0.x), you also can use Logcat & Co..

Keep in mind that every action the device performs "scrolls on" the ring buffer, so older events get flushed out; installing an app will do so, but the other actions as well: screen tapped/swiped etc. are also events. I'd suggest starting with Settings › About › Status if you're after the time your device was robbed of its card.

As for the modified files: At least the Playstore app periodically checks things in background (not sure about the Youtube app here).

Improve this answer
4
  • Thank you for your detailed response. Having plugged my phone into my computer, and having removed the battery while I was inspecting the inside of my phone, I pretty much removed the possibility of using the first two suggestions. I will check into any other logs I can find though. This is definitely a learning experience for me. Thank you so much.
    – Nasha Rios-Guzman
    Jul 6, 2015 at 16:17
  • Forgot about that, sorry! That removes #3 as well, I'm afraid, as logs are not written to storage (also see: Does android keep a log of when it starts?). // Edit: Only thing I can think about is asking your carrier to check for "drop-outs" – i.e. times in the given "window" where your device cut-off its connection to the network.
    – Izzy ♦
    Jul 6, 2015 at 16:19
  • Ah, okay. Well, that's also a good suggestion, so I can at least try that.
    – Nasha Rios-Guzman
    Jul 6, 2015 at 16:54
  • Good luck with that! To make them more willing to help you, remind them you've got "sensitive information" on that card (which is not a lie, as "personal information" always counts as "sensitive" – at least for "sensitive people").
    – Izzy ♦
    Jul 6, 2015 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .