Dealing with a Galaxy Grand 2 (SM-G710L) utilized chip off extraction method and in Physical analyzer I am seeing a Phone Activation Date consistent with a time right after the alleged incident along. Also the data on the phone starts after the incident consistent with a reset. Is there anyway I can confirm the reset, or would that be the phone activation date?
This is the date/time the phone was first activated, either as a new device or after a factory reset. You could do comms checks to show the device was in use before the date/time that you are presented with in PA, to rule out the 'new device' option.
Have a look at Cache/Root/recovery/last_log
At the top you will see
Starting recovery on <timestamp>
then further down you will see something like
Command "/sbin/recovery" "–wipe_data"
and still further
– Wiping data…
Formatting /data…
Formatting /data…
Creating filesystem with parameters
This timestamp relates to the factory reset. At least this was the case with a Samsung Galaxy S3 GT-I9300 running OS 4.3 (Jelly Bean) discovered by testing with a reference device.