In the previous post I ordered artifacts by evidential strength. This time: where I start looking, and why the starting point decides what I find. People expect me to have a fixed list of search terms. I don’t. What I…

For twenty-one Fridays I have documented Apple Unified Log artifacts on this site. This week I write down something I have never made explicit: how I actually read a log. An artifact table tells you what exists in the AUL.…

Every log line in the Unified Log answers three separate questions, and it is tempting to believe it answers all of them at once. It does not. The subsystem and process registration tell you where the event was born. The…