It is not uncommon for users to go through and “clean up” or delete data that they do not want to leave behind on smartphones. This can include selectively deleting messages, clearing device cache, or browsing/chat history, deleting media files or databases, installing third-party cleanup utilities, removing entire applications directories, or even invoking a device wipe.

A completely clean device may look suspicious, but there are many legitimate reasons that may cause a user to wipe a device. Based on just the data left on the device, we may be able to get a good idea of when the wipe occurred.