In Magnet AXIOM 3.11.0 and higher, you can now process .dar images created using Cellebrite for full filesystem extractions of iOS devices (including from CAS and UFED 4PC).
- UFD extractions for iOS contain four timestamps: changed, modified, accessed and created. The changed, modified, and accessed timestamps are stored inside the .dar image. However, the created timestamp is stored in a separate file, external to the .dar file, called system_metadata.plist. You can find the .plist file alongside the .dar file in the original extraction folder (where you’ll also find a .udf file).
- For information about processing .dar images in Magnet AXIOM, log in to the Customer Portal to review Process a Cellebrite .dar image so Creation times are included in your evidence.