When the user wipes and then the system reboots,
here are some files of interest that we can actually
look at showing when the device was set up.
Now, where you have to be careful
is, what happens if the person wipes their device
and the battery is weak?
So if the battery is weak, maybe they
have to charge it before it boots.
So anything you find with system startup,
I would say, in your report, that these are systems startup
times which is likely to be right after the device was
wiped or first time of setup.
So we can see .xml tags with wipe time.
We're going to see that in appops,
so application operations XML.
If it's Pixel, it's going to be in setupwizard.
If it's Samsung, it's going to be in SecSetupWizard.
Digital well-being, which we talked about-- everything
that keeps track of the apps that are running and app usage.
The very first time these devices start up,
it's going to create a brand new app usage directory.
That's going to be a big part of this next lab.
And then there's internal.db.
We talked about external.db for SD card.
Internal.db has a date_added column
that is going to be created upon startup.
So it's very important that you know this.
If you're taking the cert, please make sure you
know the different devices and the file paths
where you're going to find this information.