FF Community,
Â
Wanted to know if anyone would happen to be able to assist me in locating the following information (if it exists). I have a Cellebrite Advanced Logical Image of an iPhone 7 running iOS 13.5.1.
Â
It looks like the phone should be checkm8 compatible but i'm not entirely sure if performing this kind of extraction would be helpful in finding what i'm looking for anyway.Â
Â
Appreciate any assistance.Â
Â
1. com.apple.mobileSMS.plist -Â I can see message retention set to 30 days - Is there anyway to tell when this was set to 30 days? PLIST modified data reflects date of collection. Are you aware if a checkm8 Extraction maybe able to paint a better picture of when this occurred?
Â
I don't believe iOS Stores when this option would have been set to 30 days.
Â
2. Setting for "Find my iPhone - On/Off" - Are you aware if this setting is stored in an artifact on the phone? Do you know if a checkm8 extraction may reveal this information?Â
https://www.cellebrite.com/en/upgrade-from-null-detecting-ios-wipe-artifacts/
Take a look at the Cellebrite Blog by Heather Mahalik - Senior Director of Digital Intelligence and Ian Whiffin - Sr. Digital Intelligence Expert.
Even though you may not find the absolute answer, but a very good insight you can get to determine your case.