The main methods for wiping an iOS device occur through the device or the Find My iPhone application. To wipe the iOS device, simply log into the device and go into the General > Settings and select Erase All Contents and Settings. The device commences a wipe, theoretically rendering all data unrecoverable. Keep in mind that this is device-dependent and recovery method-dependent because some traces on iOS devices that have been wiped have been recovered.

Wiping a device may delete all traces to evidence relating to your investigation. The best methods to determine if a wipe occurred include examining the timestamps on the device and examining the file system for the .obliterated file.¹

On most devices, you may see the presence of the .obliterated file, which is created when an iOS device is wiped.¹ The .obliterated file is located in the /private/var/root folder. The presence of the .obliterated file shows that the iOS device was wiped at some point; however, the exact date cannot be determined based on the examination of this file alone, but the modify date is a good indication. The file should be zero bytes in size and may not always exist. Again, the different iOS devices and version affect the creation of this file. If you find an .obliterated file, try to correlate the datetime of that file to the activated date. To obtain this file, a Full File System extraction is required.  The com.apple.purplebuddy.plist from /root/private/var/mobile/Library/Preferences/ has an entry of interest and is captured via a backup.  There are additional files that will also help, but again, you will need a Full File system to access the /private/var/root/Library/Logs/MobileContainerManager/conterinermanagerd.log.X and logd.0.log found in private/var/db/diagnostics/.²   For the conaintermanagerd.log, you may find several files that are appended with numbers (0,1,2, etc.) The oldest file will have the largest number, which means the one that is holding the most recent wipe information is the one that starts with 0. The file logd.0.log tracks timezone changes. When a user sets up an iPhone, the select a region/timezone and this file are updated.

References:

[1] https://for585.com/wipe

[2] https://for585.com/wipeartifacts

Below is an example of the file system view containing the .obliterated file. The modify time of this file is a good indication of when it was wiped.