±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33043
New Yesterday: 2 Visitors: 149

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

UFED PA reporting timestamps from 2069

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

UFED PA reporting timestamps from 2069

Post Posted: Sun Nov 12, 2017 9:56 pm

I've come across something weird with an iphone 7 extraction. Using UFED PA 6.3.12.34, I acquired an advanced logical download of an iPhone 7, A1778, MDL MN8X2, iOS ver 11.0.1.

The download went as normal and all looked good until I started looking closer at the data. For some reasons the SMS, MMS and Chats are all showing the same date/time stamp 19/01/2069 1347 hrs.

All other files (call logs etc) are reporting correct normal timestamps, this is only occuring with the message data. There are no whatsapp or any third party messaging apps so I can't compare that to see if this is iOS related.

The phone itself had the correct time/date at time of examination and was not connected to any network (flight mode).

I'm going to attempt another look at the phone to see if this was a one off glitch, but was wondering if anyone else has seen this before or has any idea what's going on.  

Adam10541
Senior Member
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Mon Nov 13, 2017 7:16 am

Open the extraction again in UFED 6.4 and it is solved there.

RonS  

RonS
Senior Member
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Mon Nov 13, 2017 10:46 pm

Thanks Ron will do.  

AdamS
Newbie
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Mon Nov 13, 2017 10:49 pm

Oops, forgot about that old account Smile

Thanks Ron  

Adam10541
Senior Member
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Tue Nov 14, 2017 11:10 am

- RonS
Open the extraction again in UFED 6.4 and it is solved there.


Looks like it may be the "SMS, iMessages and MMS records are missing the UTC value for devices running iOS 11.0.1." issue mentioned as fixed in the 6.4 release notes, or something very closely related.  

athulin
Senior Member
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Tue Nov 14, 2017 11:18 am

If you want more detail, Heather did a great blog post on the iOS 11 timestamps here:
smarterforensics.com/2...in-ios-11/

Jamie  

mcman
Senior Member
 
 
  

Re: UFED PA reporting timestamps from 2069

Post Posted: Tue Nov 14, 2017 11:44 am

- mcman
If you want more detail, ...


Perfect -- thanks!  

athulin
Senior Member
 
 

Page 1 of 1