From hits to a reconstruction: search term sets for the Unified Log (Part 2 of 2) – Thesis Friday #32
Key finding – One Unified Log hit proves little. Hits from different…
Fridays are for artifacts
Decode. Analyze. Understand.
Fridays are for artifacts
Decode. Analyze. Understand.
The Friday Files
A hit is not a trace: search terms that mislead (Part 1 of 2) – Thesis Friday #31
Key finding The cheatsheet separates four levels at which one USB cable…
From device to searchable text: how I work with the Unified Log – Thesis Friday #30
Key finding – On the busy device I tested, the entries that…
The stop rule: absence needs proven coverage – Thesis Friday #29:
Key finding An empty search result in the Apple Unified Log only…
Unified Log retention on a busy vs idle iPhone (iOS 26) – Thesis Friday #28
Key finding Unified Log retention is not a fixed number of hours.…
Backward reasoning in Unified Log analysis – ALR principle 4, Thesis Friday #27
Anchored Log Reconstruction, principle 4 Key finding Start from a state the…
Touch ID vs password unlock in the Apple Unified Log (macOS 26) – Thesis Friday #26
Key finding On macOS 26.6.2 the keybag transition gives away the unlock…
Proximity is not causality in Unified Log analysis – ALR principle 3, Thesis Friday #25
Key finding Entries microseconds apart only show that the device was busy.…
Recovering a dialed number from the Apple Unified Log (iOS 26) – Thesis Friday #24
Key finding On iOS 26.6 the dialed number appears unredacted in kPhoneNumber…
An external time anchor for Unified Log analysis – ALR principle 2, Thesis Friday #23
Key finding Start with a moment that did not come from the…
Evidential strength in Unified Log analysis – ALR principle 1, Thesis Friday #22
Key finding The less aware a user was that an action would…
Why one Apple Unified Log entry is never enough – Thesis Friday #21
Key finding Every Unified Log line tells you where an event was…
CarPlay sessions in the Apple Unified Log (iOS 26) – Thesis Friday #20
Revised edition, 2 August 2026. The original version of this post was…
Emergency SOS in the Apple Unified Log (watchOS and iOS) – Thesis Friday #19
Key finding An Emergency SOS started on an Apple Watch (watchOS 26.2)…
Apple Watch button presses in the Apple Unified Log (watchOS 26) – Thesis Friday #18
Key finding On watchOS 26.2 the Carousel process logs a Digital Crown…
Keyboard typing in the Apple Unified Log (iOS) – Thesis Friday #17
Key finding Every key press on the iOS on-screen keyboard is logged…
Collecting the Apple Unified Log with UFADE (video tutorial)
Key finding UFADE (Universal Forensic Apple Device Extractor) is an open-source GUI…
MacBook Touch ID unlock in the Apple Unified Log (macOS 15) – Thesis Friday #16
Key finding On a MacBook Pro M4 with macOS 15.6.1, a Touch…