Factory reset SM-G9...
 
Notifications
Clear all

Factory reset SM-G935F

Clairejbb
(@clairejbb)
New Member

Hi guys! 

I was wondering if anyone could help with locating a timestamp for a factory reset Samsung Galaxy S7 edge (SM-G935F). I have a case where it would be really helpful to identify when this device was reset or when it was set up again... I have identified a date which seems to fit but I am not sure I understand what exactly it relates to.. I have located the date within the physical extraction in the EFS partition.... within the root > TEE > gk_context_sub_96. Could anyone help me with what this relates to??

Many Thanks!!

Quote
Topic starter Posted : 17/11/2020 3:41 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Check the date of the creation of /data/data !!!

ReplyQuote
Posted : 14/12/2020 9:13 pm
Clairejbb
(@clairejbb)
New Member

@passcodeunlock How do I do that??

ReplyQuote
Topic starter Posted : 18/01/2021 11:28 am
passcodeunlock
(@passcodeunlock)
Senior Member

If in root shell over adb:

ls -al /data/data

If you have an image of it, browse there with your forensic analyzer program and check it's date in the filesystem structure.

 

ReplyQuote
Posted : 18/01/2021 11:39 am
Chlo22
(@chlo22)
New Member

@passcodeunlock I'm having a similar issue. What db would I need to look in to find this information? I'm using Cellebrite Physical Analyser. Thanks

ReplyQuote
Posted : 18/01/2021 12:47 pm
Share: