Ian Whitson and I wrote a paper called "Upgrade from null,"
that went through the DFIR peer review.
And the entire concept of the paper
was detecting wipes on iOS devices.
Everything we wrote about Ian included in his tool ArtEx.
And what was really cool is, because we
live in different time zones, we were
able to uncover interesting time stamps
that Apple was doing again.
So when we look down here, we could see device wipe.
You can see the date/time 9/22/2020 at 13:26.
It tells you the device was wiped.
And it's pulling this from containermanagerd.log0.
Now, do you notice, it says line three.
It's so specific.
So we go to line three, and look at the time stamp.
September 22, 10:26, September 22 13:26.
So this is because he's taking the time
stamp that's shown in UTC and converting it to Eastern time.
We go over, and it says did not find last build info.
We must be upgrading from pre-9.3.1,
or this is erase install.
That's fantastic evidence.