Keyboard typing in the Apple Unified Log (iOS) – Thesis Friday #17

This week a colleague shared some interesting artefacts related to the on-screen keyboard in iOS and asked me to validate them and provide forensic interpretation. The result: a consistent sequence of artefacts in the Apple Unified Log (AUL) that reveal how users interact with the keyboard.

Below I will detail three main interaction artefacts:
Touch Down, Touch Up, and Touch Dragged. Plus examples of application-specific entries.

Artefact 1: Touch Down

2025-10-03 11:26:10.427571+0200  localhost MobileNotes[651]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

2025-10-03 11:26:10.427597+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0adbe40, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchDown: enableTelemetry=YES

2025-10-03 11:26:10.445349+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0adbe40, process, end] [com.apple.TextInput:KeyboardSignposts] appTouchDown: enableTelemetry=YES

• Timestamp: 2025-10-03 11:26:10
• Process: MobileNotes
• Subsystem: UIKitCore / KeyboardSignposts
• EventMessage: appTouchDown with enableTelemetry=YES
• Explanation: This artefact marks the moment a user presses a key on the on-screen keyboard. It represents the keystroke initiation.

Artefact 2: Touch Up

2025-10-03 13:07:22.072907+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0d53660, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchUp: enableTelemetry=YES

• Timestamp: 2025-10-03 13:07:22
• Process: MobileNotes
• Subsystem: UIKitCore / KeyboardSignposts
• EventMessage: appTouchUp with enableTelemetry=YES
• Explanation: This artefact logs the release of the pressed key. It may also indicate when the user slides upward slightly to access the extended character menu

2025-10-03 13:07:22.072930+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0d87ed0, process, begin] [com.apple.TextInput:KeyboardSignpostsEphemeral] task<missing message>

• Timestamp: 2025-10-03 13:07:22
• Process: MobileNotes
• Subsystem: UIKitCore / KeyboardSignpostsEphemeral
• EventMessage: task<missing message>
• Explanation: A supporting ephemeral marker that appears alongside appTouchUp. It is not a direct record of user input but serves as a system annotation bracketing the end of a touch sequence.

Artefact 3: Touch Dragged

2025-10-03 11:26:11.407648+0200  localhost MobileNotes[651]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch drag

2025-10-03 11:26:11.407663+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad17246c0, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchDragged: enableTelemetry=YES

• Timestamp: 2025-10-03 11:26:11.407663
• Process: MobileNotes
• Subsystem: UIKitCore / KeyboardSignposts
• EventMessage: appTouchDragged with enableTelemetry=YES
• Explanation: This artefact indicates the begin of the swipe across the keyboard.

2025-10-03 11:26:11.407780+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad17246c0, process, end] [com.apple.TextInput:KeyboardSignposts] appTouchDragged: enableTelemetry=YES

• Timestamp: 2025-10-03 11:26:11.407780
• Process: MobileNotes
• Subsystem: UIKitCore / KeyboardSignposts
• EventMessage: appTouchDragged with enableTelemetry=YES
• Explanation: This artefact indicates the end of the swipe across the keyboard.

Application-Specific Artefacts

These keyboard interactions are logged within the context of the active application. That means forensic practitioners can tie the interaction to a specific app.

For example:

Apple Mail

2025-10-03 11:28:20.901236+0200  localhost MobileMail[679]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Safari

2025-10-03 11:29:44.641978+0200  localhost MobileSafari[618]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Youtube

2025-10-03 11:33:21.706407+0200  localhost YouTube[725]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

ChatGPT

2025-09-17 08:12:10.319057+0200 0x7b75f3  Default  ChatGPT: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Conclusion

The Apple Unified Log captures a complete trail of user interaction with the on-screen keyboard:

• appTouchDown shows when a key is pressed.
• appTouchUp records when it is released, including extended character menus.
• appTouchDragged reflects swipe motions across keys.
• Ephemeral events provide additional system markers that frame these interactions.

By linking these artefacts to the running application, investigators gain precise insight into where and how a device was used. The iOS keyboard is therefore not just an input method, it is a source of clear forensic evidence.

© 2026 Tim Korver — Thesis Friday. Licensed under CC BY-NC-ND 4.0. Method: Anchored Log Reconstruction (ALR). Commercial or training use requires written permission. See Copyright and Use.