Hello everybody and happy new year.
I would like to ask what does 'Last Activation Time' property, from un iPhone's Advanced Logical Extraction using UFED Physical Analyzer mean?
I thin, but maybe I'm wrong, it means the last time the device was set to the factory default, isn't it?
Thanks and regards!
Anyway, if 'Last Activation Time' doesn't mean the last time the phone was set to the factory default, which property in an UFED report is the one which means the time the phone was set to the factory default?
I'm starting to suspect that 'Last Activation Time' means the last time the owner set on the phone, but I cannot find the property which means the time the phone was set to factory default.
Thanks!
Skywalker,
If you google "Blackbag tech iphone wiped" - Blackbag Technologies has a blog post about the artifacts to look for indications an iPhone was factory reset (in a nutshell, look for a zero-byte .obliterated file in the data/root path); there will be a date/time stamp on that, and it might not always still exist.
Thanks
Skywalker,
If you google "Blackbag tech iphone wiped" - Blackbag Technologies has a blog post about the artifacts to look for indications an iPhone was factory reset (in a nutshell, look for a zero-byte .obliterated file in the data/root path); there will be a date/time stamp on that, and it might not always still exist.
Thanks
Could it be possible to find it in an UFED's Advanced Logical Extraction?