This week, I shifted my focus to the most common companion of the iPhone: the Apple Watch. While touch events on iOS are well-documented, physical button interactions on the Watch, specifically the Digital Crown and the Side Button, provide a unique forensic signal of deliberate user action.

I conducted these tests on an Apple Watch running watchOS 26.2. To capture the necessary data, I triggered a co-sysdiagnose by holding both the Digital Crown and the Side Button for approximately one second. This action creates a combined diagnostic package on the paired iPhone. Within the extracted .logarchive, I focused on how the system distinguishes between different types of physical pressure.

Artifact 1: Digital Crown Interaction (Down)

The Digital Crown is the primary navigation tool. Physical presses are handled by the Carousel process, the graphical interface shell for watchOS.

2025-12-17 09:33:17.064737+0100  localhost Carousel[471]: (CarouselPlugins) Created Activity ID: 0x5d15a, Description: Crown down

• Timestamp: 2025-12-17 09:33:17.064737 (UTC+1)
• Process: Carousel
• Subsystem: CarouselPlugins
• EventMessage: Created Activity ID: 0x5d15a, Description: Crown down

Explanation: This artifact marks the exact moment the Digital Crown was physically depressed. In a forensic timeline, “Crown down” events are key indicators of a user attempting to return to the watch face or wake the device.

Artifact 2: Side Button (Held vs. Long-Held)

The Side Button (the flat button below the Crown) has multiple functions depending on the duration of the press. The logs show a clear progression from the initial physical hold to the system’s classification of a “long-press” (often used for SOS or Power Off menus).

Hardware Initiation: Button Held

2025-12-17 09:34:10.483963+0100  localhost Carousel[471]: (CarouselPlugins) Created Activity ID: 0x5d862, Description: Button held

Forensic Interpretation: This is the baseline entry. It confirms the mechanical sensor in the Side Button registered physical depression. At this stage, the system is in a “wait-and-see” state, capturing the raw input before classifying the gesture.

Intent Classification: Button Long-Held

2025-12-17 09:34:11.085398+0100 localhost Carousel[471]: (CarouselPlugins) Created Activity ID: 0x5d863, Description: Button long-held

Forensic Interpretation: Precisely 601 milliseconds after the initial press, Carousel re-classifies the event. This is the most critical artifact for proving User Intent. A fleeting or accidental touch would not persist long enough to trigger the long-held status. This indicates a deliberate, sustained press by the user.

Software Response: UI Activation

2025-12-17 09:34:11.127884+0100 localhost Carousel[471]: (WatchNotificationsUIKit) Created Activity ID: 0x5d864, Description: Update Alerts Key Window

Forensic Interpretation: Just 42 milliseconds after the long-press is confirmed, the WatchNotificationsUIKit subsystem takes over. This log confirms that the operating system successfully translated the physical hold into a UI action—likely preparing the “Power Off / SOS” slider window. It bridges the gap between hardware manipulation and visible software response.

Conclusion

The Apple Watch is a high-fidelity source of interaction data. By examining the Carousel process, we can reconstruct a user’s physical journey with the hardware. From a simple “Crown down” to a complex “Button long-held,” the Apple Unified Log provides the granularity needed to confirm that an interaction was intentional and human-led.

Happy hunting!