Every log line in the Unified Log answers three separate questions, and it is tempting to believe it answers all of them at once. It does not. The subsystem and process registration tell you where the event was born. The event message tells you what was recorded. Only the reconstructed sequence, the process, tells you how it actually happened. An artifact is a data point. An investigation needs a chain.

This distinction is not academic. It is the difference between reporting that a face was detected and proving that a device was unlocked by its owner’s face.

Where: Process and Subsystem Registration

Every entry carries its origin. The emitting process (kernel[0], biometrickitd[116], WidgetRenderer_Default[228]) and the subsystem tag (com.apple.BiometricKit:Daemon-Common, com.apple.chrono:keybag) place the event inside the architecture of the operating system.

This metadata is the map. It tells an examiner which layer is speaking, hardware driver, security daemon, or UI framework. Therefore how much evidentiary weight the statement deserves. A camera driver reporting a detected face is not the same authority as the keybag reporting a state transition.

What: The Event Message

The message body is the payload: flags, booleans, identifiers, temperatures. It is factual, timestamped, and narrow. It reports a condition observed by one component at one microsecond.

What it does not contain is intent, causality, or outcome. The message is a photograph, not a film.

How: The Process

The reconstruction only appears when entries from different layers are correlated on the timeline. Consider a Face ID unlock, compressed into roughly two milliseconds:

2026-03-10 14:50:43.367360+0100 localhost kernel[0]: (AppleH13CameraInterface) PearlCamFrameReceived - isFaceDetected=1, isBracketedCaptureFrame=1, isUserEngaged=1, hasAttention=1, hasGlasses=1, hasOcclusion=0, hasEyeOcclusion=0, fIDfsmFDStatus=2, sensorTemp=30, isFIDValidFrame=1, isERDataValid=0, isMDDataValid=0, isAttnDataValid=1

The kernel, through the AppleH13CameraInterface driver, reports that the TrueDepth camera captured a frame containing a face. Note what this line proves in isolation: a face was in front of the sensor, the user was engaged (isUserEngaged=1), attention was present (hasAttention=1), the eyes were not occluded (hasEyeOcclusion=0), and the frame was valid for Face ID processing (isFIDValidFrame=1).

It does not prove an unlock. It proves a face was looking at a phone.

2026-03-10 14:50:43.368979+0100 localhost biometrickitd[116]: (BiometricSupport) [com.apple.BiometricKit:Daemon-Common] identities:withClient: -> <private>

1.6 milliseconds later, biometrickitd — the biometric daemon — is queried for identities on behalf of a client. This is the matching layer. And here we meet the second problem: the interesting part is redacted as <private>. The daemon confirms that a biometric evaluation took place, but the result of that evaluation is not in the log.

Still no unlock. Only an attempt.

2026-03-10 14:50:43.369613+0100 localhost WidgetRenderer_Default[228]: (ChronoServices) [com.apple.chrono:keybag] Transition: locking -> unlocked

Another 0.6 milliseconds later, the keybag state transitions from locking to unlocked. This is the outcome, but it arrives from an entirely unrelated process. WidgetRenderer_Default is a UI component observing the keybag; it has nothing to do with biometrics. In isolation, this line proves only that the device became unlocked. It says nothing about the method.

Only the three together support the conclusion: a face was presented with attention, a biometric identity check was performed, and the keybag transitioned to unlocked all within 2.3 milliseconds. The unlock method is not stated anywhere. It is inferred from proximity in time across three layers.

The Negative Case

The inverse is where the process reasoning earns its keep. A PearlCamFrameReceived line with isFaceDetected=1 and hasAttention=1, followed by a biometrickitd query, followed by no keybag transition, tells an equally forensic story: a face was presented and rejected, or the user looked at the device without unlocking it.

The absence of the third link changes the meaning of the first two entirely. An examiner who reports only the camera artifact has reported a fact and implied a falsehood.

Why This Makes AUL Research Hard

This is precisely what makes Unified Log research complex, and it is worth naming the reasons explicitly:

• Distributed causality. The cause (camera), the evaluation (biometrickitd) and the effect (keybag) live in three different processes and three different subsystems. Nothing in the log links them but the clock.
• Privacy redaction. The decisive value, the match result is <private>. Enabling logging profiles changes what you see, which means the artifact set itself depends on the acquisition method.
• Millisecond correlation windows. The chain closes in ~2 ms. Sorting by subsystem, filtering per process, or working from a tool that groups entries by category will break it. The timeline is the only correct view.
• Volatility. These entries live in the ring buffer. They are not persisted state; they are a rolling window that will overwrite itself.
• The correlation is not documented. No Apple document states that this triplet equals a Face ID unlock. The interpretation rests on repeated observation under controlled conditions, and it must be validated against a dataset before it belongs in a report.

Disclaimer: The sequence described here is consistent within current observations on this hardware and iOS version. Frame flags, subsystem names and emitting processes vary between generations, and further large-scale validation is required before treating any individual flag as decisive.

Conclusion

The artifact tells you where it came from and what was observed. It does not tell you what happened. What happened is a property of the sequence and the sequence is something the examiner constructs, not something the device hands over.

Report a single line and you report a fragment. Report the chain, including the links that are missing, and you report an event. In Unified Log forensics, the process is the artifact.

Happy hunting

© 2026 Tim Korver — Thesis Friday. Licensed under CC BY-NC-ND 4.0. Method: Anchored Log Reconstruction (ALR). Commercial or training use requires written permission. See Copyright and Use.