Apple’s Unified Logs (AUL) are a treasure of forensic data, offering deep insight into system-level events and user interactions. As part of my Thesis Friday series, I’m highlighting a subtle but powerful artefact: screen orientation events.

While they may seem trivial at first glance, these events can reveal crucial behavioral context.

The Hardware: Apple M-Series coprocessors

The Apple M-series coprocessors are motion coprocessors used by Apple Inc. in their mobile devices. First released in 2013, their function is to collect sensor data from integrated accelerometers, gyroscopes and compasses and offload the collecting and processing of sensor data from the main central processing unit(CPU).Artefact: Screen Orientation Wikipedia : Apple Motion coprocessors

The artifacts : Screen orientation

2025-03-09 14:55:41.557754+0100 localhost backboardd[67]: (CoreMotion) [com.apple.locationd.Motion:Orientation] Received orientation. (FaceUp to Portrait) Timestamp 1106.888068

2025-03-09 14:55:52.061356+0100 localhost backboardd[67]: (CoreMotion) [com.apple.locationd.Motion:Orientation] Received orientation. (Portrait to LandscapeLeft) Timestamp 1117.390323

2025-03-09 14:56:15.801970+0100 localhost backboardd[67]: (CoreMotion) [com.apple.locationd.Motion:Orientation] Received orientation. (LandscapeLeft to PortraitUpsideDown) Timestamp 1141.131226

2025-03-09 14:56:16.807819+0100 localhost backboardd[67]: (CoreMotion) [com.apple.locationd.Motion:Orientation] Received orientation. (PortraitUpsideDown to LandscapeRight) Timestamp 1142.137198

Now we wil break it down:

• Timestamp: 2025-03-09 14:55:41.557754+0100 Precise moment (UTC+1) when the device orientation changed.
• Process: backboardd – a key system daemon responsible for handling user interface events.
• Subsystem: CoreMotion – gathers motion data from sensors like the gyroscope and accelerometer.
• EventMessage: [com.apple.locationd.Motion:Orientation] Received orientation – indicates a transition from one device orientation to another.

Transitions logged:

• FaceUp -> Potrait = device lays down with screen up and moves up to portrait
• Portrait -> LandscapeLeft = device orientates from portrait to upside to the left
• LandscapeLeft -> PortaitUpsideDown = device orientates from upside to the left to the upside down
• PortraitUpsideDown-> LandscapeRight = device orientates from upside down to upside to the right.

Extra notes:

I recorded this with pauses and the screen on. I noticed in my research that the artifacts of the screen orientation are less (because of the logging moments) when the screen is turned off. But it is recorded when I was slower in my movements.

Conclusion

Sensor events like screen orientation may seem mundane, but in digital forensics, context is everything. When layered with other logs, these artefacts can provide a nuanced behavioral profile.

Next week Thesis Friday #3: Application launch artifacts

Licensed under CC BY-SA 4.0.

Feel free to share or adapt the work — with attribution and under the same license.