good afternoon,
assuming the handset clock is accurate, check the timestamp attributes for the re-initialised file system. also consider checking the network records for the associated telephone number - you should see a tiny bit of GPRS/data activity at the moment the remote wipe command was sent to the device. you may also want to contact Apple and/or the network provider in many instances the user will remote wipe and then try to cancel their accounts. this can give you further time references to work with.
all the best,
ross @afentis
↧