Episode 9: iBeg to DFIR – What Happens When A Device Gets Wiped? Top Ten Questions Answered
In this episode, we answer the top 10 questions surrounding wiped devices as well as methods to enable iOS reconstruction of activities and the creation of a timeline of events.
- How do you know if a device has been wiped?
- What data is recoverable from a wiped device?
- Has the device been reset?
- Has the device been tampered with? If, so was it on purpose?
- How to digitally retrace the steps of device activity?
- Does the type of data collection matter on wiped devices?
- Which files can you trust on a device?
- Is there data that can give dates and times in an understandable format?
- How did a user get to a certain location?
- What are the best ways to know when the device was wiped or first used?
Wiped iOS Device
Heather will use one of her own test mobile-device images to show you good files to start with when investigating iOS devices, including:
- log.X – Examine content for “is an erase install”
- log.X – Review the log
- .obliterated – If it exists!
- SQLitedb – Creation date of container
- apple.purplebuddy.plist – “GuessedCountry” date
- storedata and Notes.sqlite – Creation date
Wiped Android Device
We’ll look at Android devices in Episode 10.
Stay tuned for Heather’s blog on Cellebrite’s site and the submission to DFIR Review.
Send ideas to ibegtodfir (at) cellebrite.com
Register for the next iBeg to DFIR episode here.