Key finding
A downloadable cheatsheet (PDF) with the log commands I use most in Unified Log forensics, from collecting a logarchive to filtering with predicates. The log command only runs on macOS.
If you’re working with Apple Unified Logs, knowing how to navigate the command-line interface is essential. This week, I’ve compiled a cheatsheet that covers the key log CLI commands available on macOS.
From collecting logarchives to filtering with predicates, this guide walks you through the commands most relevant to digital forensics. Whether you’re triaging on-scene or working on timeline reconstruction, this cheatsheet will save you time and help you surface artifacts faster.
© 2026 Tim Korver — Thesis Friday. Licensed under CC BY-NC-ND 4.0. Method: Anchored Log Reconstruction (ALR). Commercial or training use requires written permission. See Copyright and Use.