Thesis Friday #27: Backward reasoning from a provable endpoint
Anchored Log Reconstruction, principle 4 The question you will be asked At…
Fridays are for artifacts
Decode. Analyze. Understand.
Fridays are for artifacts
Decode. Analyze. Understand.
The Friday Files
Thesis Friday #26: Same unlock, three different stories
What the Unified Log records about Touch ID, passwords and the device…
Thesis Friday #25: Proximity is not causality
Anchored Log Reconstruction, principle 3 Two entries sit three hundred microseconds apart.…
Thesis Friday #24: Recovering a dialed number from the Unified Log
Today’s topic is the dialled phone number. It sits unredacted in the…
Thesis Friday #23: The anchor comes from outside the log
Anchored Log Reconstruction, principle 2 In the previous post I ordered artifacts…
Thesis Friday #22: Reading the Unified Log by evidential strength, not by timestamp.
Anchored Log Reconstruction, principle 1 For twenty-one Fridays I have documented Apple…
Thesis Friday #21: Why a single artifact never tells the whole story
Every log line in the Unified Log answers three separate questions, and…
Thesis Friday #20: Project Stark – Forensic Reconstruction of the CarPlay Handshake
Revised edition, 2 August 2026. The original version of this post was…
Thesis Friday #19: Emergency SOS – Decoding the Cross-Device “Help” Handshake
Following my previous research into physical button haptics, I’ve shifted focus to…
Thesis Friday #18: Apple Watch Crown and side button interactions.
This week, I shifted my focus to the most common companion of…
Thesis Friday #17: Touch Events on the iOS On-Screen Keyboard
This week a colleague shared some interesting artefacts related to the on-screen…
UFADE short Tutorial
Exploring UFADE: A Forensic Tool for iOS Data Extraction In the realm…
Thesis Friday #16: Unlocking a MacBook with the Touch ID Sensor
The summer break is officially over, and it’s time to continue digging…
Thesis Friday #15 – Generating a Sysdiagnose via AssistiveTouch
The summer break has officially started, which means I’ll be switching to…
Thesis Friday #14: AUL – Touch Events
This week, I focused on a subtle but powerful forensic signal in…
Thesis Friday #13: AUL – Detecting Airplane Mode Activation in iOS 26 Beta
This week I examined a forensic trace that is often underestimated in…
Thesis Friday #12: AUL – First Glance at iOS 26
This week, I took my first forensic look at iOS 26 beta, using…
Thesis Friday #11: How to – CLI – Cheatsheet
If you’re working with Apple Unified Logs, knowing how to navigate the…