±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35965
New Yesterday: 0 Visitors: 156

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iOS device reset date

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

xandstorm
Senior Member
 

iOS device reset date

Post Posted: Sep 07, 19 15:17

Hi guys,

Silly question probably but for some reason I am unable to find the correct answer.

Having an iPad 2nd generation on my desk that has been reset back to factory settings recently.
Is there a way to figure out when exactly the device has been reset back to factory setting the last time?

iOS version: 9.3.5
Model: MC774E/A

Thanks a lot guys.

Saludos,
Lex  
 
  

deeFIR
Member
 

Re: iOS device reset date

Post Posted: Sep 09, 19 06:32

What tools do you have access to?

sms.db is created when the device is setup. So if it's wiped and initialised as default, the creation date/time of sms.db would be shortly after it was wiped.  
 
  

passcodeunlock
Senior Member
 

Re: iOS device reset date

Post Posted: Sep 09, 19 15:23

Or longer after wipe...

This question can't be answered by analyzing only the device.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

xandstorm
Senior Member
 

Re: iOS device reset date

Post Posted: Sep 10, 19 12:51

- deeFIR
What tools do you have access to?

sms.db is created when the device is setup. So if it's wiped and initialised as default, the creation date/time of sms.db would be shortly after it was wiped.


Any tool necessary to get the job done.
Will try this, thank you for the advise.

Rg,
Lex  
 
  

xandstorm
Senior Member
 

Re: iOS device reset date

Post Posted: Sep 10, 19 12:52

- passcodeunlock
Or longer after wipe...

This question can't be answered by analyzing only the device.


Could you elaborate on that a little please?
That would highly appreciated.

Thanks!

Rg,
Lex  
 
  

deeFIR
Member
 

Re: iOS device reset date

Post Posted: Sep 11, 19 02:52

- xandstorm
- deeFIR
What tools do you have access to?

sms.db is created when the device is setup. So if it's wiped and initialised as default, the creation date/time of sms.db would be shortly after it was wiped.


Any tool necessary to get the job done.
Will try this, thank you for the advise.

Rg,
Lex


Just to clarify, that's assuming that the device has just been wiped and then setup immediately - not wiped, left at the 'Hello' screen and then setup at a later date. I also haven't tested it with the latest revision of iOS - so I'd suggest conducting a test first.  
 
  

passcodeunlock
Senior Member
 

Re: iOS device reset date

Post Posted: Sep 11, 19 09:47

@deeFIR: You answered yourself, the sms.db is created after the system setup. Tests have been conducted earlier.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 1