Can the time a duress wipe happened be determined?

DollyRags

Can the time a duress wipe occurred be recovered?
Can someone forensically examining the phone tell the difference between a wipe that occurred 10 minutes ago or 10 days ago?

Assume the phone has not been factory reset since the wipe.

I'd appreciate if anyone who knows how it works at a low level could answer this.
The usefulness of a duress wipe is significantly increased if it's impossible to determine when it occurred.
I know the OS version will provide a lower bound.

nandohyphen1

DollyRags Can the time a duress wipe occurred be recovered?
Can someone forensically examining the phone tell the difference between a wipe that occurred 10 minutes ago or 10 days ago?

I don't think it is determinable. Did you see this?
https://grapheneos.org/features#duress

DollyRags

nandohyphen1 I've read that. It certainly seems likely the time cant be recovered.

I just want to know if anyone more familiar with it at the lower level can conclusively say no timestamps that would reveal the approximate wipe time will remain afterwards.

nandohyphen1

DollyRags yeah I don't think you can see the time, but of course, I've never tried using the duress pin, so I don't know for sure. :)

MLG-443

I'd like to have express confirmation for that too !

becomeparmesan

Not having any expertise but assuming files are being deleted and rewritten during the wipe, this would certainly be visible in their properties as "last changed" etc.

GrouchyGrape

becomeparmesan that would be a slow, inefficient, and unreliable method. Think more along the lines of duress pin deleting the key necessary for decryption. Technically, the data still resides on the flash modules, but it's now infinitely more difficult to extract than it was before when protected by a passphrase/pin.

Foggy

GrouchyGrape I have no special knowledge but I assume it would reformat the data partition which would cause the phone to do the out of the box setup again. The question is whether the files/directories written either on first boot or on first setup give away any clues about when that was done.

I ran a terminal app and did ls -l on a few places. I'm seeing some 2023 dates which tally with when I setup my phone, but I wouldn't want to confirm that definitively. (Android severely restricts what the terminal app can see)

011100100110000101101101

I tried the duress pin on a new gOS install, it didn't reset to default (Pixel) OS, just let me factory reset back to Graphene

userofgos

011100100110000101101101 it didn't reset to default (Pixel) OS

It's not supposed to.

011100100110000101101101 just let me factory reset back to Graphene

This is how it is designed to work. :)

de0u

011100100110000101101101 Installing GrapheneOS on a device removes Google's Pixel OS from the device.

Novalissoide

011100100110000101101101 didn't reset to default (Pixel) OS

You expected
Factory Settings= PixelOS, which would lie dormant there for user to return home for.
That was just a bit funny.
No intended mocking, I get these kind of late insights all the time 😉

de0u

Novalissoide Part of the problem is that "factory reset" is not a good description of what the function does. Even if a vendor OS is in use, "factory reset" does not restore the very first version of that OS that was flashed onto the device.

Novalissoide

de0u yes, it's open to interpret it like there being a sort of hard coded archaic OS there out of the factory, and the Pixel OS was there before the user install of e.g. GrapheneOS. Also there's the AOSP-identical parts adding to that intuition.

final

When a device resets, it could be possible to tell when the OS first initialized though a more thorough forensic analysis that would likely require access to the OS filesystem. It wouldn't be possible to pretend it was reset at a different time. There'd be a clear time gap between the OS timestomped date and any actual usage.

How the factory reset happened, most likely not.

This would apply to any other platform or operating system.