This week, I focused on a subtle but powerful forensic signal in iOS: touchscreen interaction. These touch gestures can in fact reveal user intent, physical interaction, and even pre-unlock behaviour.

I ran a series of controlled tests on an iPhone running iOS 18.5, where I tapped the screen while it was off. The result? Three artifacts, clearly logged by backboardd, responsible for handling input and display events.

Artifact: Digitizer Event with Contact

2025-07-10 09:32:20.173443+0200  localhost backboardd[68]: (HSTouchHIDService) [com.apple.Multitouch:Plugin] [SA] Dispatching digitizer event with 2 children, _eventMask=0x20002 _childEventMask=0x20002 Cancel=0 Touching=1 inRange=1

---

Timestamp: 2025-07-10 09:32:20.173443 (UTC+2)
Process: backboardd
Subsystem: Multitouch:Plugin
EventMessage:
[SA] Dispatching digitizer event with 2 children, _eventMask=0x20002 _childEventMask=0x20002 Cancel=0 Touching=1 inRange=1 → This log indicates that the digitizer detected physical contact while the screen was off. The flags Touching=1 and inRange=1 confirm active input. The presence of Touching=1 is a key indicator of actual finger contact, distinguishing this from passive motion or proximity events.

Artifact: Tap to Wake Registered

2025-07-10 09:32:20.173754+0200  localhost backboardd[68]: [com.apple.BackBoard:TouchEvents] received tapToWake

Timestamp: 2025-07-10 09:32:20.173754 (UTC+2)
Process: backboardd
Subsystem: TouchEvents
EventMessage:
received tapToWake → The system recognised the gesture as a Tap to Wake event — a user action that attempts to activate the display without unlocking. This is handled within the TouchEvents subsystem, which is critical when identifying intentional user interaction.

Artifact: Contact Presence: Touching

2025-07-10 09:32:20.173773+0200  localhost backboardd[68]: [com.apple.BackBoard:TouchEvents] contact 0 presence: touching

Timestamp: 2025-07-10 09:32:20.173773 (UTC+2)

Process: backboardd

Subsystem: TouchEvents

EventMessage: contact 0 presence: touching

→ This log confirms that contact point 0 was registered as actively touching the screen. Unlike general motion or proximity, the state presence: touching is a clear indicator of physical human input at the digitizer level. The event is processed through the TouchEvents subsystem, which tracks and classifies live touch interactions — including taps, swipes, and gestures.

→ This log confirms that contact point 0 was registered as actively touching the screen. Unlike general motion or proximity, the state presence: touching is a clear indicator of physical human input at the digitizer level. The event is processed through the TouchEvents subsystem, which tracks and classifies live touch interactions — including taps, swipes, and gestures.

Conclusion

This test demonstrates that physical screen interaction, even while the display is off or the device is locked, leaves behind clear and interpretable traces in the Apple Unified Log.

The presence of:

• Touching=1 in a digitizer dispatch event
• received tapToWake
• contact 0 presence: touching

confirms that the user made direct contact with the touchscreen, triggering input classification by the system.

All these events are routed through the TouchEvents subsystem of backboardd, which acts as the primary layer for translating raw touch input into recognisable gestures. Its presence in the log validates that the input was not ambient, accidental, or purely sensor-based but rather a true interaction event.

For forensic timelines, this offers a critical signal between the screen-off state and any subsequent unlock or biometric activity. In other words, TouchEvents confirms intent.

Happy hunting!