Google has added a new Intrusion Logging feature to Android Advanced Protection, giving investigators a new source of forensic evidence when investigating suspected mobile compromises.
The feature records security and network events and stores them in an encrypted form in the user’s Google account. Google says the logs are protected so that only the user can access them, with data retained for a rolling 12 months.
The logs can help investigators reconstruct activity surrounding a suspected attack, including security events, network activity and application-related events. This could be particularly useful when spyware attempts to remove traces from the device itself.
Intrusion Logging is opt-in and must be enabled before an incident occurs, meaning it cannot recover evidence from an attack that happened earlier. Google also worked with civil-liberties and press-freedom organizations while developing the feature.
Alongside Intrusion Logging, Android 17’s Advanced Protection adds USB restrictions, stronger accessibility controls, WebGPU disabling and additional authentication protections.
The move marks a notable shift: forensic logging is becoming a built-in mobile security feature rather than something investigators have to reconstruct after an attack.