Android Intrusion Logs - A First Look

**Executive summary:** This report evaluates Android 16's Intrusion Logging (IL), a user-controlled, encrypted forensic feature that records per-app DNS lookups, connection events, and rich security events (process launches with binary hashes, ADB commands, unlock attempts, etc.), retained for up to 12 months and backed up to the owner's Google Account; the authors validated IL on Pixel hardware, demonstrated its investigative value, and documented limitations (apps using DoH, missing Wi‑Fi history, installer source, interactive shell contents, and backup latency) and immature tooling, while recommending early enrollment and improved APIs for scalable, privacy-preserving collection.