If you see the welcome screen, fantastic.
If you get that screenshot, that's
a great indicator to you on when that person wiped their device
and at first rebooted it.
There's also this file called db_agreement
that we can see here.
And you can see that we have the versions, the filters,
the date/time stamp, and what it actually was.
So when the person agrees and says,
yes, I agree to this, a good indicator of the first reboot
and setup after a wipe.