Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding An empty search result in the Apple Unified Log only counts as evidence if you have shown that the archive covers your time window, and covers it for the kind of line you searched for. The archive’s own…
Key finding Unified Log retention is not a fixed number of hours. On an iPhone in daily use the kernel entries of an unlock were gone within 13.2 hours, while on an idle reference phone they were complete after 87.8…
Key finding Entries microseconds apart only show that the device was busy. Before linking them, check whether the order matches how the process runs, whether the timing matches reality, and whether the processes are actually connected. A prewarmCamera entry right…
Key finding Start with a moment that did not come from the log, such as the time of a collision or a witness statement, and let the investigative question set the window around it. An absence only means something if…
Key finding The less aware a user was that an action would be logged, the harder the entry is to dispute. A Face ID camera frame outranks a passcode unlock, because anyone who knows the code can produce the latter.…
Key finding Every Unified Log line tells you where an event was born (subsystem and process) and what was recorded (the message). How it happened only follows from the reconstructed sequence. With cause and effect spread over separate processes and…
Revised edition, 2 August 2026. The original version of this post was published on 27 March 2026 and described the CarPlay handshake on iOS 18. Since then the iLEAPP CarPlay module reported that the vehicle-UUID entries described here did not…
Key finding An Emergency SOS started on an Apple Watch (watchOS 26.2) can be followed across both devices. The watch logs “Button long-held” and, 2.9 seconds later, an emergency location assertion. The paired iPhone then logs sosTriggeredOnPairedDevice and enters emergency…
Key finding Every key press on the iOS on-screen keyboard is logged by UIKit under KeyboardTouch as touch down, touch up or touch dragged, inside the process of the active app, for example MobileMail. That tells you when someone typed…
Key finding A sysdiagnose started from the AssistiveTouch menu is logged by assistivetouchd. On iOS 18.2.1 the entry reads “Generating sysdiagnose”, on iOS 12.5.7 “Generating sysdiagnose from AssistiveTouch menu”. That separates it from a sysdiagnose triggered with the hardware buttons,…