1\ How to prove an iphone was wiped 🔎👇
#dfir #mobileforensics
When a user wipes their phone, it generally results in the creation of a file ".obliterated". This file is located:
/private/var/root
This isn't enough to identify the timestamp of when the wipe occurred (...cont)
#dfir #mobileforensics
When a user wipes their phone, it generally results in the creation of a file ".obliterated". This file is located:
/private/var/root
This isn't enough to identify the timestamp of when the wipe occurred (...cont)
2\ The file "containermanagerd.log" stores the timestamp of when a wipe or an upgrade occurred on the device 😈
You can find the file here:
private/var/root/Library/Logs/MobileContainerManager
<3
You can find the file here:
private/var/root/Library/Logs/MobileContainerManager
<3
Loading suggestions...