In section 3, I mentioned the importance
of AddressBook.sqlite.db.
It's in bold here because this file has consistently
been the same across all iOS devices.
If you think the user wiped their device,
look for obliterated, look at the other files I just
mentioned, and compare it to the creation
date of AddressBook.sqlite.db.
If you see that AddressBook.sqlite.db
is around that time, it's typically
when the device reboots, this will get a new creation time
stamp.
And then look at the contents inside of it.
If you see that the contents of the contacts are older,
this is a symptom of someone wiping their device
and restoring.
Now, some of these others may support the creation time
stamp.
Notes has been pretty consistent,
voice mail sometimes, but AddressBook.sqlite.db
is your most consistent.
You can also compare the creation time of these files
to third-party apps.
If you see the SMS or address book was created yesterday,
but third-party apps are from three years ago,
what that means is the person wiped their device yesterday,
used the same iCloud to pull down those applications
to their device.
So these are the date and time stamps on the actual file,
not the contents inside of the container.