Skip to content
No results
  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
  • Subscribe
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Home
  • Apple Unified Log
    • What is the Apple Unified Log (AUL)?
    • How to investigate the Apple Unified Log
    • ALR Method
  • Posts
    • Artifacts
    • ALR Method
    • HowTo
  • How it started
  • Contact
  • Copyright
  • Privacy
Thesis Friday – Fridays are for artifacts
Fridays are for artifacts

Decode. Analyze. Understand.

  • Artifacts

Emergency SOS in the Apple Unified Log (watchOS and iOS) – Thesis Friday #19

Key finding An Emergency SOS started on an Apple Watch (watchOS 26.2) can be followed across both devices. The watch logs “Button long-held” and, 2.9 seconds later, an emergency location assertion. The paired iPhone then logs sosTriggeredOnPairedDevice and enters emergency…

  • Tim Korver
  • January 16, 2026
  • Artifacts

Apple Watch button presses in the Apple Unified Log (watchOS 26) – Thesis Friday #18

Key finding On watchOS 26.2 the Carousel process logs a Digital Crown press as “Crown down” and a side button press as “Button held”. If the press continues, “Button long-held” follows about 600 milliseconds later, which is the strongest sign…

  • Tim Korver
  • December 19, 2025

© 2026 Tim Korver — Thesis Friday. Blog content licensed under CC BY-NC-ND 4.0. Workshop and training material: all rights reserved. All log data originates from the author's own reference devices. No case data is used. This is a personal research publication and does not represent the position of any employer or working group. Copyright and Use · Contact.