Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding On iOS 26 beta 1, CoreTelephony logs isAirplaneMode = 1 when airplane mode goes on and isAirplaneMode = 0 when it goes off. In my test on an iPhone 12, Bluetooth Low Energy scanning continued the whole time,…
Key finding On iOS 26 beta the core Face ID entry, PearlCamFrameReceived, is the same as on iOS 18. What changed is the context around it: the face-to-camera distance in millimetres, an explicit “Face in view” from SpringBoard, and which…
Key finding A downloadable cheatsheet (PDF) with the log commands I use most in Unified Log forensics, from collecting a logarchive to filtering with predicates. The log command only runs on macOS. If you’re working with Apple Unified Logs, knowing…
Key finding On an iPhone 6 with iOS 12.5.7, Touch ID leaves kernel entries for finger on and finger off. The Home button press is logged as “Home Button Was Pressed”, and a passcode unlock appears under softwareupdateservicesd as “Device…
Key finding When a cable is connected, powerexperienced logs “plugin state changed to 1”. A RestrictedPerfMode entry in the same millisecond shows pluggedIn 1 and display 1, with every session flag at 0 (CarPlay, Siri, audio, NFC). That combination points…
Key finding Each press of a volume button is logged twice. First backboardd writes a HID event (VolumeIncrement, usage 0xE9, downEvent:1), then about nine milliseconds later SpringBoard writes rawVolumeIncreasePress or rawVolumeDecreasePress. These entries show that someone physically pressed the button…
Key finding A logarchive from log collect covers far more than the one inside a sysdiagnose. In my tests an iPhone held 14 days against 2, a Mac 30 against 2 and an iPad 15 against 10. The CLI archives…
Key finding sudo log collect –device –output <file>.logarchive on a Mac acquires the Unified Log from a connected device. Treat that logarchive as your original, hash it and work only on copies. From a copy, export time-bounded slices with log…
Key finding Opening a native app from the home screen leaves a fixed three-step pattern in SpringBoard within four milliseconds. The three entries are “Allowing tap for icon view”, “Launching application” with the bundle ID, and “transition source: HomeScreen”. The…
Key finding This post holds a one-page flowchart (PDF, CC BY-SA 4.0) for deciding whether to preserve a sysdiagnose or collect the Unified Log directly. For the measured difference between the two, see #7. It’s Friday, and I’m working on…
Key finding A tap on the Phone icon produces three SpringBoard entries within three milliseconds. First the tap is allowed for com.apple.mobilephone, then the icon tap is registered (the icon itself is redacted), and then a transition request from HomeScreen…
Key finding Every change in screen orientation is logged by backboardd under com.apple.locationd.Motion:Orientation, with the old and the new state, for example FaceUp to Portrait. With the screen off, fewer transitions were logged in my tests. The entries show that…
Key finding A single kernel entry, PearlCamFrameReceived from AppleH13CameraInterface, records that the TrueDepth camera detected a face and whether the user was looking at the screen (hasAttention=1). It shows presence and attention at that microsecond. On its own it does…