Decode. Analyze. Understand.
Decode. Analyze. Understand.
Key finding On macOS 26.6.2 the keybag transition gives away the unlock method: “locked -> inBioUnlock” after Touch ID, “locked -> unlocked” after a password. A rejected finger leaves sensor activity and NO-MATCH but no state change. A password unlock…
Key finding Every key press on the iOS on-screen keyboard is logged by UIKit under KeyboardTouch as touch down, touch up or touch dragged, inside the process of the active app, for example MobileMail. That tells you when someone typed…
Key finding Tapping the screen while it is off leaves three backboardd entries within half a millisecond: a digitizer event with Touching=1, “received tapToWake” and “contact 0 presence: touching”. Together they show physical contact with the screen, before any unlock…