iOS - Message Retention and Find my iPhone Artifact
Wanted to know if anyone would happen to be able to assist me in locating the following information (if it exists). I have a Cellebrite Advanced Logical Image of an iPhone 7 running iOS 13.5.1.
It looks like the phone should be checkm8 compatible but i'm not entirely sure if performing this kind of extraction would be helpful in finding what i'm looking for anyway.
Appreciate any assistance.
1. com.apple.mobileSMS.plist - I can see message retention set to 30 days - Is there anyway to tell when this was set to 30 days? PLIST modified data reflects date of collection. Are you aware if a checkm8 Extraction maybe able to paint a better picture of when this occurred?
I don't believe iOS Stores when this option would have been set to 30 days.
2. Setting for "Find my iPhone - On/Off" - Are you aware if this setting is stored in an artifact on the phone? Do you know if a checkm8 extraction may reveal this information?
Take a look at the Cellebrite Blog by Heather Mahalik - Senior Director of Digital Intelligence and Ian Whiffin - Sr. Digital Intelligence Expert.
Even though you may not find the absolute answer, but a very good insight you can get to determine your case.