iOS - Message Reten...
 
Notifications
Clear all

iOS - Message Retention and Find my iPhone Artifact

cs1337
(@cs1337)
Member

FF Community,

 

Wanted to know if anyone would happen to be able to assist me in locating the following information (if it exists). I have a Cellebrite Advanced Logical Image of an iPhone 7 running iOS 13.5.1.

 

It looks like the phone should be checkm8 compatible but i'm not entirely sure if performing this kind of extraction would be helpful in finding what i'm looking for anyway. 

 

Appreciate any assistance. 

 

1. com.apple.mobileSMS.plist -  I can see message retention set to 30 days - Is there anyway to tell when this was set to 30 days? PLIST modified data reflects date of collection. Are you aware if a checkm8 Extraction maybe able to paint a better picture of when this occurred?

 

I don't believe iOS Stores when this option would have been set to 30 days.

 

2. Setting for "Find my iPhone - On/Off" - Are you aware if this setting is stored in an artifact on the phone? Do you know if a checkm8 extraction may reveal this information? 

Quote
Topic starter Posted : 24/08/2020 10:36 pm
Rosia
(@rosia)
New Member

https://www.cellebrite.com/en/upgrade-from-null-detecting-ios-wipe-artifacts/

Take a look at the Cellebrite Blog by Ian Whiffin - Sr. Digital Intelligence Expert.
Even though you may not find the absolute answer, but a very good insight you can get to determine your case.

ReplyQuote
Posted : 04/08/2021 5:39 pm
Plan_B liked
Share: