Notifications
Clear all
Topic starter
18/02/2021 3:02 pm
Hia,Â
Got a question, did anyone manage to prove based on iTunes backup (Later on examined forensically) that date/time was changed on a device manually?Â
I am suspecting that those changes could be stored at:
/private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plist
OR
/private/var/mobile/Library/Preferences/com.apple.timed.plistÂ
Â
If this is the case, the question is whether the actual change time stamp is stored there and from what time to what is has been changed?Â
If anyone has ever managed to prove this, please send poke on me priv.Â
Thanks.Â
19/02/2021 9:24 pm
CurrentPowerlog.PLSQL might contain this kind of information, but i doubt it will be available in an itunesbackup.Â