How to find and read boot up log files? My phone's SD card got stolen yesterday, and I'm trying to find a way to read the boot up logs. I had left it at work by accident, and I know that it had to have been stolen by one of our employees in the 8 hour window it was there. Now, I pretty much have my suspicion of who took it, but I need a definite point of evidence I can show my boss before I start asking to check our camera files (pointed outside of the breakroom, not actually one in it to certifiably catch anyone). So, seeing as my phone was on and charging the whole time I left it, that someone would have to take my battery out to take the SD card, and that the phone was already booted up when I came back and picked it up--I figure this is my way to tell exactly who it was by tracking back to that time in the room and seeing who exactly was there.

I can't control what this person does with my SD card or the info on it, but I don't care too much seeing as I have nothing to hide. I'm just really pissed because I had a lot of family pictures and pictures of my late dog on there, and I want to pin the person for stealing my crap, tell them to return my card or get me a new one, and get them out of here.

Also, this is unrelated to the boot files, but I connected my phone to my laptop and it shows some Android data folders were edited at a time when I wasn't with the phone yesterday (com.android.vending and com.google.android.youtube, which has a recently edited cache). I'm guessing this either has to do with an automatic update or someone using my phone...I can't see any files in the folder, only when they were last edited. If there's a way you can help me understand what's going on with this and to differentiate what happened, I would also appreciate it.

Thank you!
Unfortunately for you, the Android log files use a "ring buffer" (think of it as an Ouroboros), so you might not be able to see the startup logs anymore. But here are some things you can do:


Check the "battery monitor" in Settings. Provided you didn't put your device to charge again since, it should show you how long it's been running without being attached to a charger
Using a terminal app or adb shell, run the command uptime – which tells you exactly how long the device has been running since it was last powered up (should also be listed in Settings › About › Status on your device)
different logs can be obtained via logcat, dmesg, and others (see our logging tag-wiki). On ICS (Android 4.0.x), you also can use Logcat &amp; Co..


Keep in mind that every action the device performs "scrolls on" the ring buffer, so older events get flushed out; installing an app will do so, but the other actions as well: screen tapped/swiped etc. are also events. I'd suggest starting with Settings › About › Status if you're after the time your device was robbed of its card.

As for the modified files: At least the Playstore app periodically checks things in background (not sure about the Youtube app here).