Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding UFADE (Universal Forensic Apple Device Extractor) is an open-source GUI tool by Christian Peter. It collects the Unified Log, makes a logical backup, pulls crash reports and starts a sysdiagnose. Collecting is the first step; for interpreting what…
Key finding A downloadable cheatsheet (PDF) with the log commands I use most in Unified Log forensics, from collecting a logarchive to filtering with predicates. The log command only runs on macOS. If you’re working with Apple Unified Logs, knowing…
Key finding sudo log collect –device –output <file>.logarchive on a Mac acquires the Unified Log from a connected device. Treat that logarchive as your original, hash it and work only on copies. From a copy, export time-bounded slices with log…
Key finding This post holds a one-page flowchart (PDF, CC BY-SA 4.0) for deciding whether to preserve a sysdiagnose or collect the Unified Log directly. For the measured difference between the two, see #7. It’s Friday, and I’m working on…