Decode. Analyze. Understand.
Decode. Analyze. Understand.
For twenty-one Fridays I have documented Apple Unified Log artifacts on this site. This week I write down something I have never made explicit: how I actually read a log. An artifact table tells you what exists in the AUL.…
The summer break is officially over, and it’s time to continue digging deeper into the Apple Unified Log (AUL). Up until now, my focus has been mostly on iPhones, but this week I shifted towards MacBook artefacts. What makes this…
The summer break has officially started, which means I’ll be switching to a lighter posting rhythm for the coming weeks. Expect a new post every two weeks until the end of August. But even during the holidays, the Apple Unified…
If you’re working with Apple Unified Logs, knowing how to navigate the command-line interface is essential. This week, I’ve compiled a cheatsheet that covers the key log CLI commands available on macOS. From collecting logarchives to filtering with predicates, this guide walks…
Sysdiagnose or CLI Logarchive? When conducting forensic investigations on Apple devices, Unified Logs provide a treasure trove of information about user interactions, system events, and application behavior. However, the way these logs are extracted greatly influences the amount and quality…
