ALR Method

Anchored Log Reconstruction

A version-independent method for reconstructing defensible scenarios from Apple Unified Log data.

ALR is a reasoning framework for log analysis. It is scenario-driven: the scenario defines the investigative question and determines the external time anchor from which reconstruction starts. It does not define the expected outcome. Findings are ordered by evidential weight rather than by timestamp, events are linked through verified causal chains rather than temporal proximity, and an explicit stop rule requires conclusions to be withdrawn or narrowed when observable triggers appear.

ALR is version-independent. It does not depend on a fixed list of artefacts or search terms, which is why it does not expire when Apple changes what gets logged.

1. The premise

No single artefact carries a conclusion. A log entry records that a process observed something, not what a person did. Interpretation requires corroboration across parallel processes, and that requirement is what the principles below operationalise.

Thesis Friday #21: Why a single artifact never tells the whole story →

2. The six principles

1. Evidential weight ordering. User actions are ranked from unconscious and unarguable to visible and contestable. Biometric capture ranks above a screen tap.
Thesis Friday #22: Reading the Unified Log by evidential strength, not by timestamp →

2. External anchor and investigative window. Reconstruction starts from a timestamp established outside the log, such as a collision time or a time of death. The anchor defines the window, not a search term list. Thesis Friday #23: The anchor comes from outside the log →

3. Causal chains, not temporal proximity. Two events close in time are not related until the chain between them is verified. Forthcoming 21 August 2026

4. Backward reasoning from a provable endpoint. Reconstruction runs from a verified end state back towards its cause, not forward from an assumption. Forthcoming.

5. The stop rule. Observable triggers, such as zero values or a reset time base, require conclusions to be narrowed or withdrawn. Forthcoming.

6. Application across platforms. Demonstrated on iOS, iPadOS, macOS and watchOS. Forthcoming.

3. Scope and limitations

ALR governs interpretation, not acquisition. It assumes the log has been preserved by a documented and reproducible method.

The method does not remove the need for reference research. When a log result cannot be explained, that is the signal to run controlled reference testing, not to interpret forward.

All examples on this site are derived from the author’s own reference devices. No case data is used.

4. Status

ALR was first published in July 2026 on Thesis Friday.

5. Licence

The description, wording and figures on this page are published under CC BY-NC-ND 4.0. Methods are not protected by copyright. You are free to apply ALR in your own work. Attribution is requested.

Workshop and training material is not covered by this licence. All rights reserved.

6. Citation

@misc{korver2026alr,
  author = {Korver, Tim},
  title  = {Anchored Log Reconstruction (ALR)},
  year   = {2026},
  note   = {Thesis Friday},
  url    = {https://thesisfriday.com/alr}
}