For Android, evidence of wiping activity
is not as straightforward.
The difference is, all the manufacturers, all the versions
of Android, there are so many things that are different.
So what we did here was we tried to break it down
into categories for you.
So under Data Property, Persistent Properties,
you'll be able to see Reboot, Factory Reset, and Unix Epoch
time stamps on when these items occurred.
You're also going to be able to see things
like the first-in and first-out of different reboots.
All devices have to reboot after they are wiped.
You can also do--
[? Matia's ?] script, his Android triage scripts
that runs those adb commands to get some
of these persistent properties.
Bootstat is a good one.
This is going to include factory reset and last boot
time in UTC of the files.
For Samsung only, we can go to /efs/recovery/history,
and we will see multiple wipe entries.
And then, one of my favorites-- and I
worked with Josh Hickman a little bit on this.
With data/System/user s/service/data/eRR.p--
Samsung only, has the wipe time stamp and the reason.
So that's amazing stuff that we can actually
get from these devices.
Now, some of them will require full file system access,
which means you're going to have to have additional levels
of extraction to get them.