iOS 17 Image - Description and iPhone 11 iOS 17.3 Activity Extraction

Aug 27, 2026

The document describes an iOS 17 image created on an iPhone 11 previously used on iOS 16, including device specifications, iOS version details, and a step-by-step procedure. It outlines a factory reset, account provisioning, installation and population of 55 third-party apps, stock app data population, app updates, and two extractions using Cellebrite UFED. It also records timelines with timezone rules, Apple account email, and detailed activity logs for multiple apps such as AllTrails, BeReal, Brave, and Burner, including actions, timestamps, and captured messages.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages130

Reading Time5 h 28 min

AccessFree to download

Device and Image Description

Phone information

iOS version information and procedure

Account information

App installation and population

Non-stock apps (AllTrails, BeReal, Brave, Burner)

Logged actions, timestamps, and messages

iOS 17 Image DESCRIPTION An image of iOS 17 was created using an iPhone 11 that had been previously used under iOS 16. Several popular applications (apps) were populated with user data utilizing the capabilities of each individual app. The stock iOS apps were also populated with user data. Dates are in the YYYY-MM-DD format. Times vary as follows: Times between 2023-07-01 and 2023-11-04 are Eastern Daylight Time (UTC-0400) Times between 2023-11-05 and 2023-11-21 are Eastern Standard Time (UTC-0500) Times between 2023-11-22 and 2023-11-28 at 12:00 UTC are in Central European Time (UTC +0100) Times between 2023-11-28 and 2024-03-10 at 12:00 UTC are Eastern Standard Time (UTC-0500) Times after 2024-03-10 at 12:00 UTC are in Eastern Daylight Time (UTC-0400) Any data prior to 2024-01-23 at 11:16 occurred in iOS 16.1.2. That information is included in this document. Transferred media (pictures/videos) and emojis are described in (italics) . Some of the data available in the apps were sync’d with data that had been previously populated. Information about the previously populated data can be found in the documentation of the respective images, which can be found at [https://thebinaryhick.blog](https://thebinaryhick.blog). PHONE INFORMATION Make: iPhone 11 Model: A2111 (Purple) Order Number: MWLC2LL/A RAM: 4 GB Storage: 64 GB Carrier: Google Fi Phone Number: 919-579-4674 Serial: F4GZ987AN72N Wi-Fi MAC: 88:64:40:75:2A:A7 BT MAC: 88:64:40:72:54:5A IOS VERSION INFORMATION | Version: 17.3
Build: 21D50
Passcode: 3349
PROCEDURE | | --- | | 1. The phone had been previously reset to factory defaults, including a wipe of the device. iOS
16.1.2 was installed.
2. A Google Fi account was added in order to apply cellular service to the device.
3. Fifty-five (55) third-party apps were installed from the AppStore and populated with user data based on each app’s respective capabilities.
4. Stock iOS apps were populated with user data based on each app’s respective capabilities.
5. Some third-party apps were updated.
6. An extraction was performed using Cellebrite UFED.
7. The phone was updated to iOS 17.3.
8. Additional data was generated in both 3rd party and native applications.
9. A second extraction was performed using Cellebrite UFED.
APPLE ACCOUNT INFORMATION | Email Address: [thisisdfir@gmail.com](thisisdfir@gmail.com) (added to device on 2023-07-01 at 16:22) NON-STOCK APP INFORMATION The non-stock apps that were loaded and tested are alphabetically listed below. Information about the app, including user interaction, is also listed. Some apps contain previously generated data from other images (Android and iOS) . For documentation on previously generated data, see the documentation for the respective images at [https://thebinaryhick.blog](https://thebinaryhick.blog). Name: AllTrails Version Number: 18.8.0 Install Date: 2024-01-12 Install Time: 12:17 (finished at 12:19) Username: [thisisdfir@gmail.com](thisisdfir@gmail.com) Note: | Date | Time | Action | | --- | --- | --- | | 2024-01-12 | 12:21 | Login | | | 12:23 | Started hiking navigation | | | 13:38 | Stopped hiking navigation | | | 13:39 | Added picture to hike | | 2024-07-27 | 10:01 | Started hike | | | 10:38 | Ended hike | | | 13:22 | Added picture to hike from 10:01 | Name: BeReal Version Number: 1.21.4 Install Date: 2024-01-09 Install Time: 18:30 Updated Version: 2.24.0 Update Date: 2024-07-26 Update Time: 11:15 Note: | Date | Time | Action | Message | | --- | --- | --- | --- | | 2024-01-09 | 18:31 | Login | | | 2024-01-14 | 15:40 | Took a BeReal | My first BeReal! | | 2024-01-22 | 13:22 | Took a BeReal | My second BeReal for iOS 16! | | | 13:39 | Other party commented on BeReal | Nice BeReal. Sugg Farm? | | 2024-07-26 | 11:17 | Added LizD as friend | | | | | Took BeReal | | | | 11:19 | Added caption to BeReal | (BeReal taken at 11:17) | | | 12:14 | To

FAQs

What device and iOS versions are referenced in the iOS 17 image?

The image was created on an iPhone 11 running iOS 17.3 (build 21D50). Data prior to 2024-01-23 11:16 is noted as occurring on iOS 16.1.2.

What procedure was followed before and during extraction?

The phone was factory reset and iOS 16.1.2 was installed, a Google Fi account was added, 55 third-party apps were installed and populated, stock iOS apps were populated, some apps were updated, and two extractions were performed using Cellebrite UFED. The phone was updated to iOS 17.3 before the second extraction.

How are app activities recorded in the document?

Activities are logged with dates and times, using specified timezone rules, and include user actions such as logins, navigation start/stop, posting pictures, and adding captions. Some entries also include messages exchanged within apps.

Aug 27, 2026

Upload by Valentina