Factory reset SM-G9...
 
Notifications
Clear all

Factory reset SM-G935F

5 Posts
3 Users
0 Likes
1,964 Views
(@clairejbb)
Posts: 4
New Member
Topic starter
 

Hi guys! 

I was wondering if anyone could help with locating a timestamp for a factory reset Samsung Galaxy S7 edge (SM-G935F). I have a case where it would be really helpful to identify when this device was reset or when it was set up again... I have identified a date which seems to fit but I am not sure I understand what exactly it relates to.. I have located the date within the physical extraction in the EFS partition.... within the root > TEE > gk_context_sub_96. Could anyone help me with what this relates to??

Many Thanks!!

 
Posted : 17/11/2020 4:41 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

Check the date of the creation of /data/data !!!

 
Posted : 14/12/2020 10:13 pm
(@clairejbb)
Posts: 4
New Member
Topic starter
 

@passcodeunlock How do I do that??

 
Posted : 18/01/2021 12:28 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

If in root shell over adb:

ls -al /data/data

If you have an image of it, browse there with your forensic analyzer program and check it's date in the filesystem structure.

 

 
Posted : 18/01/2021 12:39 pm
(@chlo22)
Posts: 1
New Member
 

@passcodeunlock I'm having a similar issue. What db would I need to look in to find this information? I'm using Cellebrite Physical Analyser. Thanks

 
Posted : 18/01/2021 1:47 pm
Share: