I didn’t have access to my phone for a month, I’m afraid that I could have installed any software or hardware spyware. Is it possible to check it somehow by logs? Does the Android system keep logs for all operations in the system?
3 Answers
Here is some ADB commands that can help:
Dump each app and it data usage
for package in $(pm list packages | cut -f2 -d":"); do echo $package; pm dump $package | grep "Mobile network"; done;
Monitor Application
for package in $(dumpsys package | grep "Package \[" | cut -d "\[" -f2 | cut -d "\]" -f1); do
echo $package $(dumpsys package $package | grep firstInstallTime)
done;
That will list install date of all the applications on the device. You can replace "firstInstallTime" with "lastUpdateTime" to get last update time.
Some applications monitor and store the phone state in a database or a log file, you can also backup the apps in the device and try to find some useful information in these backups.
Hope it can help!
Unfortunately Android does not maintain any persistent long-term log files by default.
There are some log buffers available that can be read via adb logcat. However the logs logcat can display to you are written to a fixed size log buffer (usually between 64k and 256k). If the buffer is full the first entries are overwritten.
Depending on the log traffic per minute this buffer usually last about some minutes up to may be some hours on a device that does not log very much (some devices really do create many log entries).
Some apps my do so, but if the logs are saved in the app private directory you need a rooted device to access them Also check the sdcard/Android folder and sub-folders for logs, but don't expect too much.
Therefore in your case all you can do is to perform a factory reset and if possibly try to re-install the device from a firmware image from your device manufacturer (if the manufacturer provides them).
Then it is up to you if you trust your device or not.
No.
It's not possible to use native Android logging to definitively say that your phone was not compromised when it was out of your physical control for a month.
If a device is out of your physical control for that long, you pretty much have to assume that anyone determined enough could have tampered with anything on it, including tampering with the logs to make it look like the phone was not tampered with. If you include hardware tampering, then really the sky is the limit.
On top of that, the native system logs aren't really designed to record tampering anyway, but just to help developers with debugging.
That said, you do have to weigh the threat level here. It's one thing if you have a normal life and your phone was left with a friend for a month vs. if you are in a spy film and your phone was captured by the villain.
