Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding – On the busy device I tested, the entries that hold unlock traces were gone within about a day. Secure the log the same day. – A logarchive is a folder. Hash every file in it, save the…
Key finding An empty search result in the Apple Unified Log only counts as evidence if you have shown that the archive covers your time window, and covers it for the kind of line you searched for. The archive’s own…
Key finding Unified Log retention is not a fixed number of hours. On an iPhone in daily use the kernel entries of an unlock were gone within 13.2 hours, while on an idle reference phone they were complete after 87.8…
Anchored Log Reconstruction, principle 4 Key finding Start from a state the log can prove and work back to a cause, ruling out each alternative with captured data. On macOS a successful Touch ID match does not mean the machine…
Key finding Entries microseconds apart only show that the device was busy. Before linking them, check whether the order matches how the process runs, whether the timing matches reality, and whether the processes are actually connected. A prewarmCamera entry right…
Key finding Start with a moment that did not come from the log, such as the time of a collision or a witness statement, and let the investigative question set the window around it. An absence only means something if…
Key finding The less aware a user was that an action would be logged, the harder the entry is to dispute. A Face ID camera frame outranks a passcode unlock, because anyone who knows the code can produce the latter.…
Key finding Every Unified Log line tells you where an event was born (subsystem and process) and what was recorded (the message). How it happened only follows from the reconstructed sequence. With cause and effect spread over separate processes and…