IOS wiping-- if you find this file called obliterated,
this is a key indicator that that device has been wiped.
Now, what you have to be careful on are refurbished devices.
So let's say you drop your phone into a swimming pool.
You take it back to your network service provider,
and they give you a new phone.
The chances of that phone being brand new
are probably slim to none.
They often give you a refurbished phone,
which means it has probably been wiped.
So wiping doesn't necessarily mean that something bad
happened on the device.
I wipe a lot of my test phones to set them up
as something new.
I have wiped my own personal device
in the past to create space to upgrade when I had smaller
storage space on those iPhones.
What you want to do is try to timeline from obliterated
or some of these other files I'm going to talk about
to see if it makes sense, if it was malicious in nature,
and why.
Other files that you see listed here--
so containermanagerd.log-- do you notice it's in italics?
You're going to need a full file system
extraction to get this file.
Purplebuddy-- the com.apple.purplebuddy.plist,
you will get this with every backup.
Make sure you encrypted them.
You'll get that with advanced logical.
Every extraction should have that.
However, if you get full file system,
purplebuddy will be inside of that data.ark.plist.
And that's exactly like we saw it on lab 3.3.
The logd.0.log is interesting.
And we're going to take a look at this file
and show how that the user wiped their device
and started using it again.