Decode. Analyze. Understand.
Decode. Analyze. Understand.
Today’s topic is the dialled phone number. It sits unredacted in the Apple Unified Log (AUL). Two artefacts carry the story: one holds the number, the other shows it was typed on the device itself. Setup Device: iPhone 14, iOS…
In the previous post I ordered artifacts by evidential strength. This time: where I start looking, and why the starting point decides what I find. People expect me to have a fixed list of search terms. I don’t. What I…
For twenty-one Fridays I have documented Apple Unified Log artifacts on this site. This week I write down something I have never made explicit: how I actually read a log. An artifact table tells you what exists in the AUL.…
Every log line in the Unified Log answers three separate questions, and it is tempting to believe it answers all of them at once. It does not. The subsystem and process registration tell you where the event was born. The…
Revised edition, 2 August 2026. The original version of this post was published on 27 March 2026 and described the CarPlay handshake on iOS 18. Since then the iLEAPP CarPlay module reported that the vehicle-UUID entries described here did not…
Following my previous research into physical button haptics, I’ve shifted focus to a more critical system state: the Emergency SOS sequence. While a standard button press navigates the UI, a sustained hold on the Apple Watch (watchOS 26.2) triggers a…
This week, I shifted my focus to the most common companion of the iPhone: the Apple Watch. While touch events on iOS are well-documented, physical button interactions on the Watch, specifically the Digital Crown and the Side Button, provide a…
This week a colleague shared some interesting artefacts related to the on-screen keyboard in iOS and asked me to validate them and provide forensic interpretation. The result: a consistent sequence of artefacts in the Apple Unified Log (AUL) that reveal…
Exploring UFADE: A Forensic Tool for iOS Data Extraction In the realm of digital forensics, extracting comprehensive data from iOS devices is paramount. UFADE (Universal Forensic Apple Device Extractor) emerges as a robust, open-source Python GUI tool designed…
The summer break is officially over, and it’s time to continue digging deeper into the Apple Unified Log (AUL). Up until now, my focus has been mostly on iPhones, but this week I shifted towards MacBook artefacts. What makes this…
The summer break has officially started, which means I’ll be switching to a lighter posting rhythm for the coming weeks. Expect a new post every two weeks until the end of August. But even during the holidays, the Apple Unified…
This week, I focused on a subtle but powerful forensic signal in iOS: touchscreen interaction. These touch gestures can in fact reveal user intent, physical interaction, and even pre-unlock behaviour. I ran a series of controlled tests on an iPhone running…
This week I examined a forensic trace that is often underestimated in mobile analysis: the moment a user manually enables or disables Airplane Mode. With the release of iOS 26 Beta 1, the Apple Unified Log now provides clear and timestamped visibility…
This week, I took my first forensic look at iOS 26 beta, using a brand-new test setup designed to replicate the conditions I used in previous analyses on iOS 18. By repeating the same interaction patterns, for example unlocks, gestures, and idle…
If you’re working with Apple Unified Logs, knowing how to navigate the command-line interface is essential. This week, I’ve compiled a cheatsheet that covers the key log CLI commands available on macOS. From collecting logarchives to filtering with predicates, this guide walks…
This week, I turned to an older Apple device: the iPhone 6, running iOS 12.5.7. Despite its age, the Apple Unified Log (AUL) on this device still reveals detailed interaction artifacts particularly around Touch ID usage, passcode unlocks and Home Button artefacts.…
This week I focused on a subtle but forensically valuable artefact: detecting when a device was physically connected to power. Or physically connected to a USB cable without charging. USB connections are often overlooked during triage, but can be critical…
As part of my ongoing research into Apple Unified Logs (AUL), this week’s focus is on physical interactions specifically, the use of the volume buttons on an iOS device. While seemingly simple, these artifacts can provide clear and timestamped evidence of user…