Decode. Analyze. Understand.
Decode. Analyze. Understand.
Anchored Log Reconstruction, principle 4 The question you will be asked At some point someone asks how you know. Not whether the log contains fingerprint lines. How you know the machine was unlocked, by that method, at that moment. The…
Anchored Log Reconstruction, principle 3 Two entries sit three hundred microseconds apart. It is tempting to read them as one event. That temptation is the most common way to get a Unified Log wrong. This post is about what I…
Anchored Log Reconstruction, principle 2 In the previous post I ordered artifacts by evidential strength. This time: where I start looking, and why the starting point decides what I find. People expect me to have a fixed list of search…
Anchored Log Reconstruction, principle 1 For twenty-one Fridays I have documented Apple Unified Log artifacts on this site. This week I write down something I have never made explicit: how I actually read a log. An artifact table tells you…
Every log line in the Unified Log answers three separate questions, and it is tempting to believe it answers all of them at once. It does not. The subsystem and process registration tell you where the event was born. The…