Skip to content
No results
  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
  • Subscribe
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Artifacts

MacBook Touch ID unlock in the Apple Unified Log (macOS 15) – Thesis Friday #16

Key finding On a MacBook Pro M4 with macOS 15.6.1, a Touch ID unlock leaves a chain from the sensor (setFingerOnState: FingerON) through powerd and coreauthd to “Device is unlocked/active”, about 95 milliseconds later. A search for “TouchID” is enough…

  • Tim Korver
  • August 22, 2025

© 2026 Tim Korver — Thesis Friday. Blog content licensed under CC BY-NC-ND 4.0. Workshop and training material: all rights reserved. All log data originates from the author's own reference devices. No case data is used. This is a personal research publication and does not represent the position of any employer or working group. Copyright and Use · Contact.