Module android 

Forensic anomaly analysis for Android MediaStore .trashed-/.pending- filenames decoded by trash_core::android.

Code	Category	Severity	Meaning
TRASH-EXPIRED-RESIDUE	Residue	Low	a .trashed- item still present though its dateExpires has passed (survived the idle sweep, still recoverable)
TRASH-MALFORMED-NAME	Structure	Low	a name with a trashed/pending prefix that does not parse as a valid token (raw name surfaced)

The expiry check needs a reference time, supplied by the caller, so the analysis stays deterministic and testable. Findings are observations, never legal conclusions: the analyst concludes.

Enums

TrashedNameAnomaly

An Android MediaStore trash-filename anomaly, with the offending name attached.

Functions

audit_trashed_name

Audit a single directory-entry name against the MediaStore trash codec. now is the reference time the item’s expiry is compared against (the caller passes the acquisition/analysis time).