Investigating Samsung Wipe History
20/12/2024 Friday
Device wiping is a term that usually refers to the process of erasing data from a device. It can involve various levels of deletion, ranging from clearing specific files or logs to performing a full factory reset. Samsung provides a service to safely and securely wipe its devices. The primary event in the wiping process occurs when the user performs a factory reset, which erases all the data on a Samsung phone and returns it to its original factory settings.
Digital Forensics Value of Samsung Wipe History
The digital forensics value of Samsung wipe history lies in understanding and analyzing when and how data is erased. This information can assist investigators in establishing a timeline of events and may highlight attempts to destroy evidence or cover tracks. By analyzing wiping activities, forensic experts can determine whether the process was initiated intentionally or accidentally. Understanding wipe history can also reveal patterns, such as repeated wipe attempts, which may indicate a deliberate effort to obscure incriminating actions.
Location and Structure of Samsung Wipe History Artifacts
Samsung Wipe History artifacts can be found at the following locations:
*/efs/recovery/history
*/data/log/recovery_history.log
Analyzing Samsung Wipe History Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Samsung Wipe History artifacts from Android machines’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Samsung Wipe History artifacts parser:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Samsung Wipe History artifacts in ArtiFast.
Samsung Wipe History:
- Request Date/Time - The date/time when this event has been initialized.
- Event Date/Time - The date/time when this event has been performed.
- Reason - The reason why this event has been performed.
- Initializer - The initializer of this event.
- Reboot Reason - The reboot reason associated with this event.
- Locale - The locale.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
