Hi guys!Â
I was wondering if anyone could help with locating a timestamp for a factory reset Samsung Galaxy S7 edge (SM-G935F). I have a case where it would be really helpful to identify when this device was reset or when it was set up again... I have identified a date which seems to fit but I am not sure I understand what exactly it relates to.. I have located the date within the physical extraction in the EFS partition.... within the root > TEE > gk_context_sub_96. Could anyone help me with what this relates to??
Many Thanks!!
Check the date of the creation of /data/data !!!
If in root shell over adb:
ls -al /data/data
If you have an image of it, browse there with your forensic analyzer program and check it's date in the filesystem structure.
Â
@passcodeunlock I'm having a similar issue. What db would I need to look in to find this information? I'm using Cellebrite Physical Analyser. Thanks
