Shutdown Checkpoints in Android 12

In scouring Josh Hickman's Android 12 test image, I came across a new folder that was previously found in previous test images. I can be found at the following path:

data\system\shutdown-checkpoints

Inside contains some plaintext files with a consistent naming convention. They can been seen titled checkpoints-<UNIX_timestamp>. Converting the UNIX timestamps it appears to match the last modified date of the files themselves.

Figure 1: checkpoints files

Let's open up one of the sample files and see what's inside.

Figure 2: checkpoints-1638954568308 file contents

We can see 3 SYSTEM shutdown requests all around the same time 2021-12-08 at 4:09am, even one that gives a reason, the battery was dead. We see a hint from Josh's documentation that the phone was dead a few hours after that when he plugged it in:

Figure 3: Power Events from documentation

Opening the other sample file "checkpoints-1635255560545" we can see more shutdown events:

Figure 4: checkpoints-1635255560545 file contents

From Josh's documentation again, we can see a reboot was performed at the same time the file indicates, 2021-10-26 at 9:39am.

Figure 5: Power Events from documentation

With these files we can find another data point of system usage, whether battery dying or restarts. It also gives us another clue of the timezone the phone was set to. As always, ALEAPP now has a parser for this.

Figure 6: Shutdown Checkpoints report in ALEAPP