Skip to content
No results
  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
  • Subscribe
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Artifacts

Sysdiagnose via AssistiveTouch in the Apple Unified Log – Thesis Friday #15

Key finding A sysdiagnose started from the AssistiveTouch menu is logged by assistivetouchd. On iOS 18.2.1 the entry reads “Generating sysdiagnose”, on iOS 12.5.7 “Generating sysdiagnose from AssistiveTouch menu”. That separates it from a sysdiagnose triggered with the hardware buttons,…

  • Tim Korver
  • July 25, 2025
  • HowTo

Apple Unified Log CLI cheatsheet (log command, PDF) – Thesis Friday #11

Key finding A downloadable cheatsheet (PDF) with the log commands I use most in Unified Log forensics, from collecting a logarchive to filtering with predicates. The log command only runs on macOS. If you’re working with Apple Unified Logs, knowing…

  • Tim Korver
  • June 20, 2025

© 2026 Tim Korver — Thesis Friday. Blog content licensed under CC BY-NC-ND 4.0. Workshop and training material: all rights reserved. All log data originates from the author's own reference devices. No case data is used. This is a personal research publication and does not represent the position of any employer or working group. Copyright and Use · Contact.