Thesis Friday #17: Touch Events on the iOS On-Screen Keyboard

This week a colleague shared some interesting artefacts related to the on-screen keyboard in iOS and asked me to validate them and provide forensic interpretation. The result: a consistent sequence of artefacts in the Apple Unified Log (AUL) that reveal how users interact with the keyboard.

Below I will detail three main interaction artefacts:
Touch Down, Touch Up, and Touch Dragged. Plus examples of application-specific entries.

Artefact 1: Touch Down

2025-10-03 11:26:10.427571+0200  localhost MobileNotes[651]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down
2025-10-03 11:26:10.427597+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0adbe40, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchDown: enableTelemetry=YES
2025-10-03 11:26:10.445349+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0adbe40, process, end] [com.apple.TextInput:KeyboardSignposts] appTouchDown: enableTelemetry=YES
  • Timestamp: 2025-10-03 11:26:10
  • Process: MobileNotes
  • Subsystem: UIKitCore / KeyboardSignposts
  • EventMessage: appTouchDown with enableTelemetry=YES
  • Explanation: This artefact marks the moment a user presses a key on the on-screen keyboard. It represents the keystroke initiation.

Artefact 2: Touch Up

2025-10-03 13:07:22.072907+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0d53660, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchUp: enableTelemetry=YES
  • Timestamp: 2025-10-03 13:07:22
  • Process: MobileNotes
  • Subsystem: UIKitCore / KeyboardSignposts
  • EventMessage: appTouchUp with enableTelemetry=YES
  • Explanation: This artefact logs the release of the pressed key. It may also indicate when the user slides upward slightly to access the extended character menu
2025-10-03 13:07:22.072930+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad0d87ed0, process, begin] [com.apple.TextInput:KeyboardSignpostsEphemeral] task<missing message>
  • Timestamp: 2025-10-03 13:07:22
  • Process: MobileNotes
  • Subsystem: UIKitCore / KeyboardSignpostsEphemeral
  • EventMessage: task<missing message>
  • Explanation: A supporting ephemeral marker that appears alongside appTouchUp. It is not a direct record of user input but serves as a system annotation bracketing the end of a touch sequence.

Artefact 3: Touch Dragged

2025-10-03 11:26:11.407648+0200  localhost MobileNotes[651]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch drag
2025-10-03 11:26:11.407663+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad17246c0, process, begin] [com.apple.TextInput:KeyboardSignposts] appTouchDragged: enableTelemetry=YES
  • Timestamp: 2025-10-03 11:26:11.407663
  • Process: MobileNotes
  • Subsystem: UIKitCore / KeyboardSignposts
  • EventMessage: appTouchDragged with enableTelemetry=YES
  • Explanation: This artefact indicates the begin of the swipe across the keyboard. 
2025-10-03 11:26:11.407780+0200  localhost MobileNotes[651]: (UIKitCore) [spid 0x6b92ccbad17246c0, process, end] [com.apple.TextInput:KeyboardSignposts] appTouchDragged: enableTelemetry=YES
  • Timestamp: 2025-10-03 11:26:11.407780
  • Process: MobileNotes
  • Subsystem: UIKitCore / KeyboardSignposts
  • EventMessage: appTouchDragged with enableTelemetry=YES
  • Explanation: This artefact indicates the end of the swipe across the keyboard.

Application-Specific Artefacts

These keyboard interactions are logged within the context of the active application. That means forensic practitioners can tie the interaction to a specific app.

For example:

Apple Mail

2025-10-03 11:28:20.901236+0200  localhost MobileMail[679]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Safari

2025-10-03 11:29:44.641978+0200  localhost MobileSafari[618]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Youtube

2025-10-03 11:33:21.706407+0200  localhost YouTube[725]: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

ChatGPT

2025-09-17 08:12:10.319057+0200 0x7b75f3  Default  ChatGPT: (UIKitCore) [com.apple.UIKit:KeyboardTouch] touch down

Conclusion

The Apple Unified Log captures a complete trail of user interaction with the on-screen keyboard:

  • appTouchDown shows when a key is pressed.
  • appTouchUp records when it is released, including extended character menus.
  • appTouchDragged reflects swipe motions across keys.
  • Ephemeral events provide additional system markers that frame these interactions.

By linking these artefacts to the running application, investigators gain precise insight into where and how a device was used. The iOS keyboard is therefore not just an input method, it is a source of clear forensic evidence.

31 Comments

  1. VVJL Login & Register | Download VVJL Slot App APK – Official Casino Link PH Experience the ultimate gaming thrill at VVJL! Access the official VVJL casino link to complete your VVJL login and register. Download the VVJL slot app APK today for the best casino games in the PH. Join now and win big! visit: vvjl

  2. [3539]N777 Online Casino Philippines: N777 Login, Register & App Download for the Best Slot Games Join N777 Online Casino Philippines for the ultimate gaming experience! Access your n777 login, complete your n777 register, and play the best n777 slot games. Secure your n777 app download today and start winning at the top n777 online casino in the PH! visit: n777

  3. [3685]PH488: The Best Online Casino Philippines for Real Money – Fast GCash Payouts & Secure Login. Experience PH488, the best online casino Philippines for real money. Enjoy a secure ph488 login and lightning-fast GCash online casino PH payouts. Sign up and win today! visit: ph488

  4. [533]789taya Online Casino Philippines: Register & Login for Top Slots and App Download Experience the best at 789taya Online Casino Philippines! Enjoy premium 789taya slot games. 789taya register & login now for big wins. Get the 789taya app download today! visit: 789taya

  5. [1271]Goperya Online Casino: Best Slots, Secure Goperya Login, Fast Register, and Official App Download for Pinoy Players. Experience the ultimate Goperya Online Casino! Enjoy secure goperya login, fast goperya register, and official goperya app download for Pinoy players. Play the best goperya slots and win big today! visit: goperya

  6. [1017]jl365 Online Casino Philippines: Quick jl365 Login, Register, and App Download for the Best jl365 Slot Games. Experience the top jl365 online casino Philippines! Fast jl365 login, easy jl365 register & jl365 app download. Play the best jl365 slot games & win big today! visit: jl365

  7. [9132]Masaya365: The Best Online Casino in the Philippines. Quick Masaya365 login, register, and sign up. Experience top Masaya365 slot games and easy app download today! Join Masaya365, the best online casino in the Philippines! Enjoy quick Masaya365 login, register, and sign up to play top Masaya365 slot games. Experience seamless gaming with our easy Masaya365 app download today. visit: masaya365

  8. [2281]Casino Official Site Philippines: Easy Login, Register & Download App for the Best Slots Online. Welcome to the Casino Official Site Philippines! Complete your casino register for an easy casino login. Casino download app now to play the best casino slots online today. visit: casino

  9. [7927]BBCCasino Official Site: Best Online Slots in the Philippines. Fast BBCCasino Login, Easy Register, and Mobile App Download for the Ultimate Gaming Experience. Experience top gaming at BBCCasino official site. Fast BBCCasino login, easy register, and BBCCasino app download. Play the best online slots in the Philippines today! visit: bbccasino

  10. [1938]555pub Online Casino Philippines: Official 555pub Login, Register & App Download for Premium Slots Experience premium gaming at 555pub Online Casino Philippines. Access the official 555pub login and 555pub register to play top-tier 555pub slots. Get the 555pub app download today for the ultimate mobile casino experience and big wins! visit: 555pub

  11. [3235]ah88 Login & Register: Top Philippines Online Slot Site. Download ah88 APK & Access Official ah88 Link Alternatif for Seamless Gaming. Join ah88, the top Philippines online slot site! Experience easy ah88 login and ah88 register processes. Download ah88 apk or use our official ah88 link alternatif to enjoy the best ah88 slot games and seamless gaming today. visit: ah88

  12. [7603]WK77 Online Casino Philippines: Fast WK77 Login, Register & Slot Link. Download the WK77 App for the Best PH Gaming Experience. Experience the best PH gaming at WK77 Online Casino. Fast WK77 login and WK77 register for top rewards. Use the WK77 slot link or WK77 app download to start winning today! visit: wk77

  13. [8563]337jili Online Casino PH: Login, Register, & App Download for Best Slot Games Experience the premier 337jili Online Casino PH. Secure 337jili login, fast 337jili register, and 337jili app download for the best 337jili slot games and big wins! visit: 337jili

  14. [3054]luckyi slots|luckyi login|luckyi giris|luckyi download|luckyi app Experience the ultimate online casino thrill at luckyi, the Philippines’ leading gaming platform. Play the best luckyi slots, enjoy a seamless luckyi login or luckyi giris experience, and stay connected on the go. Get the luckyi app via a quick luckyi download and start winning today! visit: luckyi

  15. [2610]677jili casino|677jili slots|677jili app|677jili register|677jili giris Join 677jili, the premier online casino in the Philippines. Experience top-rated 677jili slots, download the official 677jili app, and complete your 677jili register today for secure giris access and exclusive rewards. visit: 677jili

  16. [2035]MrPlay Philippines: Login & Register for Top Online Slots, Exclusive Casino Bonuses, and Easy App Download. Join MrPlay Philippines for top online slots! 🎰 Quick MrPlay login & register to claim exclusive casino bonuses. Easy MrPlay app download for mobile play. Start winning at PH’s best online casino today! visit: MrPlay

  17. [5107]Boss77 Login & Register: Best Philippines Slot Online. Official Boss77 App Download and Boss77 Link Alternatif for Secure Gaming. Experience the best Philippines slot online at Boss77. Easy Boss77 login & register. Get the official Boss77 app download & Boss77 link alternatif for secure gaming. visit: boss77

  18. [2373]PHPlus Online Casino: Top Slot Games in the Philippines. Login, Register, and Download the App to Win Big. Experience the best phplus slot games at PHPlus Online Casino Philippines! Phplus login, phplus register, or phplus download app today for your chance to win big. visit: phplus

  19. [5130]Wagiplus Philippines: Best Online Slot & Casino – Login, Register, and App Download Official Link Join Wagiplus Philippines, the best online slot & casino site. Secure Wagiplus login, fast Wagiplus register, and official Wagiplus app download. Use our Wagiplus casino link for premium slot online games today! visit: wagiplus

  21. [474]Jilicc Online Casino Philippines: Premium Jilicc Slot Games, Easy Jilicc Login & Register. Get the Official Jilicc App Download Today! Experience Jilicc Online Casino Philippines! Enjoy premium Jilicc slot games with a seamless Jilicc login and register process. Get the official Jilicc app download today for the ultimate gaming experience and big wins! visit: jilicc

  22. [4690]Superking: The Best Legit Online Casino Philippines for Real Money GCash Slots Experience the ultimate gaming thrill at Superking, the best legit online casino Philippines for real money GCash slots. As a premier destination for real money online gambling Philippines, Superking offers secure transactions, massive jackpots, and a wide variety of games. Use your Superking casino login PH today to access the best GCash casino PH and start winning big! visit: superking

  23. [4916]Taya77 Online Casino Philippines: Taya77 Login, Register, Slots & App Download Join Taya77 Online Casino Philippines for the ultimate gaming experience! Access your account via Taya77 login, complete your Taya77 register quickly, and explore premium Taya77 slot games. Get the Taya77 app download for seamless mobile play and start winning today at the most trusted online casino in the Philippines. visit: taya77

  24. [4159]PH365 Online Casino Philippines: Quick PH365 Login & Register, Exciting PH365 Slot Games, and Official App Download. Join PH365 Online Casino for the best PH365 slot games in the Philippines. Enjoy fast PH365 login & register access. Get the official PH365 app download and start winning today! visit: ph365

  25. [5378]ddbet giris|ddbet download|ddbet register|ddbet login|ddbet slots Join ddbet, the leading online casino in the Philippines! Enjoy seamless ddbet giris access, fast ddbet download for mobile, and a quick ddbet register process. Secure your ddbet login today to play the best ddbet slots and win big! visit: ddbet

  27. [2380]Taya3653 Online Casino: Top Philippines Gaming Platform. Quick Login, Easy Register, and App Download for Premium Slot Games. Experience the best at Taya3653 Online Casino, the top Philippines gaming platform. Fast taya3653 login, easy register, and premium taya3653 slot games await you. Secure your taya3653 app download today for the ultimate mobile casino experience and big wins! visit: taya3653

  28. [3898]Videoslots Philippines: Online Slots, Easy Login & Registration. Get Exclusive Bonus Codes & the Casino App. Experience top Videoslots online slots in the Philippines! Easy Videoslots login & register process. Download the Videoslots casino app and use exclusive bonus codes to start winning today. visit: Videoslots

  29. [5557]JilliAsia Casino: Best Online Slots in the Philippines. Easy Login, Register, and App Download. Experience the best online slots at JilliAsia Casino Philippines! Secure your JilliAsia login and register today to enjoy premium JilliAsia slot games. Fast JilliAsia app download available for the ultimate mobile gaming experience. Join now! visit: jilliasia

  30. [6151]Deskgame Official: Secure Login, Register & App Download for the Best Philippines Slots. Join Deskgame Official for the ultimate Philippines slots experience! Access secure deskgame login, easy deskgame register, and the deskgame app download for premium casino gaming and big wins today. visit: deskgame

  31. [1888]p828: Best Online Casino Philippines. Access p828 Login, p828 Slot, and Daftar p828 via the latest p828 Link Alternatif. Download p828 APK for premium gaming! Join p828, the best online casino in the Philippines! Experience premium gaming with top-rated p828 slot titles, secure p828 login access, and seamless daftar p828 registration via our official p828 link alternatif. Download the p828 apk today to enjoy a world-class mobile casino experience with massive jackpots and 24/7 support at your fingertips. visit: p828

Leave a Reply to mwplay88funCancel Reply

Your email address will not be published. Required fields are marked *