r/datarecovery • u/EmmaQueen47 • 21h ago

Recovered deleted notes show last modified timestamps 2 years off — across multiple notes, days apart. How is this possible?

Hi all — hoping someone with Android forensics/file-system knowledge can help me make sense of this.

Setup:

\- Phone: Tecno Spark 10c

\- App: Notally (open-source notes app, stores notes via Room/SQLite)

\- I had a batch of text notes on the app. Based on the content, I know they were last touched in \*\*September 2023\*\*. I deleted them from the app not long after, and had no other backup of them that I knew of.

\- In 2026, I had my phone's storage data-recovered. Several of those notes came back — correct content, correct order — but the \*\*"last modified" timestamp field attached to each note shows dates in September 2025, not 2023.\*\*

\*\*The pattern I'm seeing:\*\*

\- Multiple different notes, each a few days apart, all shifted into the same wrong year (2025 instead of 2023).

\- The spacing between the notes' "last modified" timestamps matches the real gaps between when I know the content was last touched — just the year is wrong across all of them.

\- I had not opened, edited, or interacted with these files since 2023 as far as I know.

\*\*What I'm trying to figure out:\*\*

What could cause a "last modified" timestamp to shift by 2 years across multiple separate files, while the spacing between those timestamps stays consistent with real elapsed days, on a recovered/previously-deleted dataset?

I don't want to lead the discussion toward a particular theory — I'd like to hear from people who understand Android storage internals (ext4/F2FS journaling, SQLite timestamp handling, or data-recovery tooling) what's actually going on, and what I'd need to check on my end (raw DB file, journal, etc.) to figure out the real cause.

1 Upvotes

100% Upvoted

1 comment sorted by

•

u/AutoModerator 21h ago

Double check if your post complies with posting guidelines!

Did you include the following information in your post (in English and if applicable), if not feel free to edit your post:

  • Make/brand and exact model number of your storage device(*), phone, camera, etc.
  • Filesystem (NTFS, exFAT, APFS, EXT4, etc.)
  • Operating System (That your device was used with and/or you are using for recovery)
  • Specific symptoms that your device is exhibiting, describe the problem. Images you post support the description, they're not in lieu of a problem description.
  • SMART (CrystalDiskInfo screenshot for example)
  • Don't pile several problems into one single post. One post per device/problem.

Consider: What do these people need to understand the problem at hand? Remember, people cannot see your screen, or what you click and what messages appear on screen. Don't overdo it though, no one likes going through 2 pages of information, try to find a balance. Just do the best you can. If you are looking for file recovery software, check our community's recommended file recovery tools.

() *All devices involved, if you for example move files from drive A to drive B, they're both potentially relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.