Reconstructing user behavior with Android and iOS app-switching artifacts.

Smartphone operating systems generate artifacts such as snapshots, state databases, and usage logs to manage application state transitions during app-switching. However, these artifacts differ across operating systems in storage location, format, and retention period, which limits the reproducibility and interpretability of forensic analysis even when the underlying user behavior is identical. Android's Protobuf-serialized records and iOS's KTX-format snapshots further complicate analysis, as their complex structures and limited tool support often necessitate manual processing. This study examines app-switching artifacts on Android and iOS to reconstruct user behavior, focusing on UsageStats, Recent Tasks, and snapshot images on Android, and KnowledgeC.db, applicationState.db, and snapshot artifacts on iOS. We analyze how each platform records temporal information and application state during app-switching, termination, and device reboot, and show that correlation across artifacts enables cross-validation, resolving the resulting inconsistencies. The results reveal discrepancies between UsageStats records and other app-switching artifacts on Android, and missing endDate values and incomplete records during abnormal termination in iOS's KnowledgeC.db. These findings demonstrate that single-artifact analysis can lead to misinterpretation. We further develop an automated tool that parses, aligns, and visualizes multiple artifacts to reconstruct app-transition flows, confirming its practical applicability to mobile forensic analysis.