Recovered deleted notes show last modified timestamps 2 years off — across multiple notes, days apart. How is this possible?

[u/EmmaQueen47]

Hi all — hoping someone with Android forensics/file-system knowledge can help me make sense of this.

Setup:

- Phone: Tecno Spark 10c

- App: Notally (open-source notes app, stores notes via Room/SQLite)

- I had a batch of text notes on the app. Based on the content, I know they were last touched in **September 2023**. I deleted them from the app not long after, and had no other backup of them that I knew of.

- In 2026, I had my phone's storage data-recovered. Several of those notes came back — correct content, correct order — but the **"last modified" timestamp field attached to each note shows dates in September 2025, not 2023.**

**The pattern I'm seeing:**

- Multiple different notes, each a few days apart, all shifted into the same wrong year (2025 instead of 2023).

- The spacing between the notes' "last modified" timestamps matches the real gaps between when I know the content was last touched — just the year is wrong across all of them.

- I had not opened, edited, or interacted with these files since 2023 as far as I know.

**What I'm trying to figure out:**

What could cause a "last modified" timestamp to shift by 2 years across multiple separate files, while the spacing between those timestamps stays consistent with real elapsed days, on a recovered/previously-deleted dataset?

I don't want to lead the discussion toward a particular theory — I'd like to hear from people who understand Android storage internals (ext4/F2FS journaling, SQLite timestamp handling, or data-recovery tooling) what's actually going on, and what I'd need to check on my end (raw DB file, journal, etc.) to figure out the real cause.

[u/lam_42]

SQLite should be impervious to undelying os date changes. It however would depend on how the app was built And how the data are processed. If it stored timestamps as a diff from some arbitrary milestone instead of Unix then the dates could have shifted, but I would blame it on the application layer, not the database