Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding The cheatsheet separates four levels at which one USB cable is written: kernel, host type, session and power state. They give four different counts. tapToWake alone is not a touch. It also appears in ProximitySensor as a mode…
Key finding An empty search result in the Apple Unified Log only counts as evidence if you have shown that the archive covers your time window, and covers it for the kind of line you searched for. The archive’s own…
Anchored Log Reconstruction, principle 4 Key finding Start from a state the log can prove and work back to a cause, ruling out each alternative with captured data. On macOS a successful Touch ID match does not mean the machine…
Key finding On macOS 26.6.2 the keybag transition gives away the unlock method: “locked -> inBioUnlock” after Touch ID, “locked -> unlocked” after a password. A rejected finger leaves sensor activity and NO-MATCH but no state change. A password unlock…
Key finding On a MacBook Pro M4 with macOS 15.6.1, a Touch ID unlock leaves a chain from the sensor (setFingerOnState: FingerON) through powerd and coreauthd to “Device is unlocked/active”, about 95 milliseconds later. A search for “TouchID” is enough…
Key finding A downloadable cheatsheet (PDF) with the log commands I use most in Unified Log forensics, from collecting a logarchive to filtering with predicates. The log command only runs on macOS. If you’re working with Apple Unified Logs, knowing…