Thesis Friday #10: AUL – Artefacts on a iPhone 6 (iOS 12.5.7)

This week, I turned to an older Apple device: the iPhone 6, running iOS 12.5.7. Despite its age, the Apple Unified Log (AUL) on this device still reveals detailed interaction artifacts particularly around Touch ID usage, passcode unlocks and Home Button artefacts.

The physical Home button on the iPhone 6 is not just a navigation control; it contains a fingerprint sensor known as Touch ID. This allows users to unlock their device using a registered fingerprint. In the logs, this interaction leaves behind specific kernel-level artefacts.

Older iPhones like the iPhone 6 are increasingly encountered in forensic cases as so-called “burner” phones. Their legacy status, lower price point, and Touch ID-only authentication make them attractive for short-term or compartmentalized use. But they still generate meaningful logs for forensic examiners.

Touch ID Usage – Artefact Pattern

When a finger is placed on the Touch ID sensor, the Secure Enclave logs two events:

Touch ID – Finger placed on sensor

2025-03-09 15:24:33.093741+0100 kernel (AppleMesaSEPDriver) message: kAppleBiometricFingerOnEvent

Timestamp: 2025-03-09 15:24:33.093741 (UTC+1)
Process: kernel
Subsystem: AppleMesaSEPDriver
EventMessage: kAppleBiometricFingerOnEvent
This marks the moment of physical contact with the fingerprint sensor.

Touch ID – Finger removed from sensor

2024-03-09 15:24:33.473797+0100 kernel message: kAppleBiometricFingerOffEvent 

Timestamp: 2025-03-09 15:24:33.473797 (UTC+1)
Process: kernel
EventMessage: kAppleBiometricFingerOffEvent
This records when the finger leaves the sensor. The duration between these two timestamps can reflect the fingerprint recognition window.

Passcode Unlock – Artefact Pattern

Passcode – Lock status changed

2025-03-09 15:24:47.831119+0100  localhost softwareupdateservicesd[139]: (SoftwareUpdateServices) [com.apple.softwareupdateservices:Common] Device lock status changed: passcodeLocked = NO

Timestamp: 2025-03-09 15:24:47.831119 (UTC+1)
Process: softwareupdateservicesd

Despite its name, softwareupdateservicesd does more than just manage iOS software updates. On older versions of iOS, particularly iOS 12.x, it also serves as a system-level notifier for changes in device state, including lock and unlock transitions.

Passcode – Device unlocked

2025-03-09 15:24:47.831126+0100  localhost softwareupdateservicesd[139]: (SoftwareUpdateServices) [com.apple.softwareupdateservices:Common] Device unlocked

Timestamp: 2025-03-09 15:24:47.831126 (UTC+1)
Process: softwareupdateservicesd
EventMessage: Device unlocked
Confirms that the unlock was fully completed and the UI is now accessible.

Home Button Press – Artefact Pattern

Touch ID interaction isn’t the only signal we can extract from the Unified Log. The physical act of pressing the Home button, a core part of user-device interaction on the iPhone 6, is also logged at kernel level.

Artefact – Home button physically pressed

2025-03-09 15:24:33.296311+0100  localhost kernel[0]: (AppleMesaSEPDriver) homeButtonEventServiceCallback: *** Home Button Was Pressed ***

Timestamp: 2025-03-09 15:24:33.296311 (UTC+1)

Process: kernel

The kernel handles low-level communication between hardware and the operating system.

Subsystem: AppleMesaSEPDriver

This Secure Enclave-related driver registers physical security-related events like biometric touches and button presses.

EventMessage:

homeButtonEventServiceCallback: *** Home Button Was Pressed ***

This indicates that the Home button was physically pressed potentially to wake the device, activate Siri, or start an unlock attempt via Touch ID or passcode.

Forensic Relevance

These artefacts allow for a complete reconstruction of the unlock process:

  • The Touch ID on/off events confirm a fingerprint-based interaction occurred — regardless of its outcome.
  • The passcodeUnlocked logs mark the point of actual access.
  • Correlating timestamps show whether a failed biometric led to fallback authentication.

This is particularly valuable when working with legacy or burner devices, where Face ID is unavailable and forensic artefacts are harder to retrieve.

Happy hunting!

31 Comments

  1. Phdream11 Online Casino: Login, Register, and App Download for Top Slot Games in the Philippines Join phdream11 online casino for the best phdream11 slot games in the Philippines. Access phdream11 login, easy phdream11 register, and the phdream11 app download to start winning today! visit: phdream11

  2. [8860]Sulit777: Best Philippines Online Casino & Slots. Easy Sulit777 Login, Register, and App Download for Big Wins. Experience the best Philippines online casino at Sulit777! Get fast Sulit777 login and register access to play top Sulit777 slot and casino games. Sulit777 download the app now for big wins and exclusive rewards! visit: sulit777

  3. [5644]PH488: The Best Online Casino Philippines for Real Money – Fast GCash Payouts & Secure Login. Experience PH488, the best online casino Philippines for real money. Enjoy a secure ph488 login and lightning-fast GCash online casino PH payouts. Sign up and win today! visit: ph488

  4. [324]Otso Casino: The Best Legit GCash Online Casino and Slots in the Philippines. Experience Otso Casino, the premier online casino Philippines destination. As the best legit GCash online casino, we offer top-tier legit online slots Philippines and secure payouts. Visit otsocasino and use your otso casino login to start winning big at the most trusted gaming platform in the country! visit: otsocasino

  5. [9440]FunBingo Philippines: Top Online Casino & Slots. Quick FunBingo Login, Register, and App Download to Play and Win Big. Experience FunBingo Philippines, the top online casino for slots! Quick FunBingo login, easy register, and FunBingo app download. Play and win big today! visit: funbingo

  6. [9728]PHCASH11: Premier Online Casino Philippines – Easy Login, Fast Register, App Download & Top Slot Games Experience PHCASH11, the premier online casino Philippines. Enjoy quick phcash11 login, fast phcash11 register, and top phcash11 slot games. Get the phcash11 app download now for the ultimate gaming experience! visit: phcash11

  8. [3565]Maxwinph: Best Casino Online in the Philippines. Login, Register, or Download the App to Play Exciting Slot Games Today. Join Maxwinph, the best casino online in the Philippines. Maxwinph register or login now to play exciting slot games. Get the maxwinph app download and win today! visit: maxwinph

  9. [6725]PH363 Online Casino: Top PH363 Slot, Easy Login & Register. Get the PH363 App Download for Philippines Players. Experience the ultimate gaming at PH363 Online Casino! Enjoy top-rated PH363 slot games with a seamless PH363 login and fast PH363 register process. Get the official PH363 app download for Philippines players and start winning today! visit: ph363

  10. [9825]Top Philippines Online Casino & Slot Games: Easy vipjl Login, Register, and Official vipjl App Download Today. Join vipjl, the top Philippines online casino for elite vipjl slot games. Experience easy vipjl login, fast vipjl register, and the official vipjl app download. Play and win big at the most trusted online gaming platform in the PH today! visit: vipjl

  11. [1362]747agent: Top Online Casino in the Philippines. Quick Login, Easy Register, App Download, and Premium Slot Games. Join 747agent, the top online casino in the Philippines. Enjoy a quick 747agent login, easy register process, and premium 747agent slot games. Secure your 747agent app download today for the ultimate gaming experience! visit: 747agent

  12. [4927]abjili app|abjili login|abjili download|abjili register|abjili giris Experience top-tier online gaming at abjili, the Philippines’ leading casino platform. Secure your abjili login, complete your abjili register, and access the latest abjili download for mobile. Get the abjili app today for seamless play and exclusive rewards. Your ultimate abjili giris gateway to big wins starts here! visit: abjili

  13. [491]PH222: Top Casino Games & Slot Online in the Philippines. Easy ph222 Login, Register, and App Download. Experience the best ph222 slot online and ph222 casino games in the Philippines. Secure ph222 login, fast ph222 register, and easy ph222 app download for big wins! visit: ph222

  14. [8011]PH987 Official Site: Your Top Destination for PH987 Slot Games. Quick Login, Easy Register, and PH987 App Download for the Best Casino Experience in the Philippines. Experience the ultimate gaming at the PH987 official site! Get quick PH987 login, easy PH987 register, and a seamless PH987 app download for the best PH987 slot games. Join the top-rated casino in the Philippines and start winning today! visit: ph987

  15. [1571]911jl Casino: The Best Online Casino Philippines with GCash. Secure Login & Fast App Download for Top Gaming. Experience the best online casino Philippines at 911jl casino. Secure your 911jl login today for premium gaming and seamless transactions with the top GCash online casino PH. Start winning now and get the 911jl app download for fast, secure access to your favorite games anytime, anywhere. visit: 911jl

  16. [2320]77jl Login & Register: Download the 77jl App for the Best Online Slots in the Philippines Experience the best 77jl slot games in the Philippines! 77jl register and 77jl login are fast and easy. 77jl download the 77jl app now for premium online casino action and big wins. visit: 77jl

  17. [1397]Jili56 Casino Philippines: Jili56 Login, Register & App Download for Top Jili56 Slot Action. Experience the ultimate gaming at Jili56 Casino Philippines! Quick Jili56 login & register to play top Jili56 slot games. Get the Jili56 app download for non-stop casino action today. visit: jili56

  18. [8480]jili5 register|jili5 casino|jili5 giris|jili5 slots|jili5 download Join Jili5 Casino, the top-rated gaming hub in the Philippines. Complete your jili5 register to play premium jili5 slots. Fast jili5 giris and jili5 download available now for the ultimate mobile casino experience! visit: jili5

  19. [4670]68jl register|68jl login|68jl giris|68jl casino|68jl download Experience the ultimate Philippines online gaming at 68jl. Complete your 68jl register to enjoy premium 68jl casino games, secure 68jl login, and big wins. 68jl download the app today for the best mobile gambling experience! visit: 68jl

  20. [7809]Experience the best iwinjili casino online in the Philippines. Secure iwinjili login, quick register, and iwinjili app download for top-rated iwinjili slots and premium gaming experiences. Join iwinjili casino online, the Philippines’ top choice! Secure iwinjili login, fast iwinjili register, and iwinjili app download for premium iwinjili slots and games. visit: iwinjili

  21. [6222]g7win login|g7win casino|g7win download|g7win register|g7win app Experience the ultimate online gaming at g7win Casino, the Philippines’ premier platform for top-tier slots and live games. Complete your g7win register today to claim exclusive bonuses, or secure your g7win login to start winning. For a seamless mobile experience, g7win download the official g7win app and enjoy the best of g7win casino anytime, anywhere! visit: g7win

  22. [4012]2jl Casino Philippines: Best 2jl Slot, Easy Login, Register & App Download Experience the best 2jl slot games at 2jl Casino Philippines. Enjoy a fast 2jl login, easy 2jl register process, and a seamless 2jl app download. Join the premier 2jl casino today and start winning big! visit: 2jl

  23. [7502]Karera Online Casino Philippines: Easy Login, Register, and App Download for the Best Slot Games. Join Karera Online Casino Philippines! Experience seamless Karera login and Karera register processes to enjoy top-tier Karera slot games. Get the Karera app download now for the ultimate mobile gaming experience and start winning today! visit: karera

  24. [9559]MPLBet Official Site: Best Philippines Slot Online. Fast MPLBet Login, Register, & App Download. Join the MPLBet official site for the best Philippines slot online experience. Enjoy fast mplbet login, easy mplbet register, and the latest mplbet app download. visit: mplbet

  26. [2921]PH333F Official Site: Secure Login & Register. Download the PH333F Slot App and Casino for the best gaming experience in the Philippines. Join the PH333F official site for the best gaming in the Philippines. Use PH333F login & register to play. Get the PH333F slot app and ph333f casino download now! visit: ph333f

  27. [9520]KingPH Online Casino Philippines: Experience top-tier slot games. Secure KingPH login, quick register, and official KingPH app download for the ultimate gaming experience. Join KingPH Online Casino Philippines for premium KingPH slot games. Experience a secure KingPH login, fast KingPH register, and official KingPH app download today! visit: kingph

  28. [7927]Gameph Online Casino Philippines: Top Slots, Easy Login & App Download Experience Gameph Online Casino Philippines! Enjoy top gameph slots with easy gameph login & fast gameph register. Secure your gameph app download today & win big! visit: gameph

  29. [8473]a777 Online Casino Philippines: The Best Legit Slots for Real Money and Easy GCash Payouts. Experience the ultimate gaming thrill at a777 Online Casino Philippines, the top destination for the best online slots PH. Secure your a777 legit casino login today to play exciting games for real money and enjoy the fastest online gambling GCash Philippines payouts. Join a777 casino real money for a safe, legit, and rewarding experience tailored for Filipino players. visit: a777

  30. [9163]88jl Casino Philippines: 88jl Login, Register, Slot Games & App Download Experience top-tier gaming at 88jl Casino Philippines. Fast 88jl login & 88jl register to play premium 88jl slot games. Secure 88jl app download for mobile. Join 88jl casino today! visit: 88jl

  31. [5128]SlotPH Casino Philippines: Login, Register & Slots Game App Download Join SlotPH Casino Philippines for the ultimate online slots experience. Secure login, fast registration, and easy app download. Play top games and win big at SlotPH today! visit: slotph

Leave a Reply

Your email address will not be published. Required fields are marked *