Today’s topic is the dialled phone number. It sits unredacted in the Apple Unified Log (AUL). Two artefacts carry the story: one holds the number, the other shows it was typed on the device itself.

Setup

Device: iPhone 14, iOS 26.6 (build 23G71). CarPlay head unit: Volvo EC40 (2026), wired, previously paired. Recordings on 2 August 2026. Six runs, three with CarPlay and three without. Same number and order of entry every time; only the input surface differed. Without CarPlay the number was typed on the phone keypad, with CarPlay on the car screen keypad. All logs come off the iPhone. The head unit does no logging.

The number is my own test number, masked as 065244****. The last four digits are always *, so the digit count stays visible.

Let’s dive in!

Artefact – The dialed number: kPhoneNumber

2026-08-02 09:18:01.128336+0200 localhost CommCenter[102]: [com.apple.CommCenter:call.provider] #I {
	"kActionId": "49B8935B-C5DA-45CE-9AC7-FCC1676F147F",
	"kActionType": 0,
	"kUuid": "2FCB034A-9F62-4707-B25D-E36BAC31DF6B",
	"kCallSourceMode": 0,
	"kPhoneNumber": "065244****"
}

Timestamp: 2026-08-02 09:18:01.128336 (UTC +2)

Process: CommCenter

The system process that handles telephony. It writes one block per call attempt.

Subsystem: com.apple.CommCenter:call.provider

The subsystem that logs the call transaction, including the number itself.

EventMessage: kPhoneNumber: 065244****

The dialled number, spelled out. This block is identical with and without CarPlay. originatingUIType is 1 in both, so it is not a CarPlay indicator. Nothing in this block tells you where the digits were entered.

Artefact – Setup and teardown: kUuid

2026-08-02 09:18:16.935733+0200 localhost CommCenter[102]: [com.apple.CommCenter:call.provider] #I {
	"kActionType": 2,
	"kUuid": "2FCB034A-9F62-4707-B25D-E36BAC31DF6B"
}

Timestamp: 2026-08-02 09:18:16.935733 (UTC +2)

Process: CommCenter

Subsystem: com.apple.CommCenter:call.provider

EventMessage: kActionType: 2, kUuid: 2FCB034A…

kActionType is 0 on setup and 2 on hang-up. kActionId is unique per transaction and links nothing. kUuid is unique per call and links setup to teardown. With multiple calls in one recording, join on kUuid.

Artefact – Redaction is navigable

... #N --->FromCSD(executeTransaction) size 1: <private>
... #I executeTransaction: After translation (size: 1):

The same transaction is logged twice, 28 microseconds apart. The first comes in from callservicesd, redacted. The second is the same transaction after translation inside CommCenter, written out in full. <private> is a property of one logging call, not of the underlying data. Stopping at <private> is stopping too early.

Artefact – A failed attempt is logged just as fully

One run holds two kPhoneNumber blocks: nine digits, then fourteen seconds later ten.

	"kUuid": "B661D998-15E2-4786-AD1F-91046D076FC4",
	"kPhoneNumber": "065244****"

	"kUuid": "D21DBA32-6C85-42A7-B3EA-484C247B981A",
	"kPhoneNumber": "065244****"

Which one connected is not in these blocks but in what follows:

... Call(StatusUpdate) InitializingMedia -> Dialing for call <private>
... Call(StatusUpdate) Disconnected -> Disconnected for call <private>

The first attempt runs to Dialing and collapses to Disconnected in 317 ms. No teardown for B661D998… ever appears. The second traverses the full chain and closes with a kActionType: 2 block for D21DBA32….

Interpretation: A kActionType: 0 block without a matching teardown is a dialled attempt, not a connected call. A number in the log is not evidence of a completed call.

Artefact – How it was entered: ContactSearchManager

2026-08-02 09:17:54.371669+0200 localhost MobilePhone[46453]: (CallsSearch) [com.apple.calls.mobilephone:ContactSearchManager] Searching for 065244****

Timestamp: 2026-08-02 09:17:54.371669 (UTC +2)

Process: MobilePhone

The phone app. On every change to the dial field it fires a contact search on the current text.

Subsystem: com.apple.calls.mobilephone:ContactSearchManager

Handles the contact lookup. Not a telephony artefact but a by-product of search, which is why it survives unredacted.

EventMessage: Searching for 065244****

The full sequence, with cancellations, reconstructs the typing:

Searching for 0
Search cancelled for 0
Searching for 06
...
Searching for 065244**
Searching for 065244***
Searching for 065244****

The last Searching for line without a matching cancellation is the field at the moment of the call, and it matches kPhoneNumber.

Interpretation: Two caveats. The search is throttled, so fast typing skips intermediate states, though the final state is always complete. And a run can open with a cancellation for a search never started in it, residue from the previous run still in the field.

Artefact – The search chain only fires on the device

Searching for counts: 13, 10, 10 in the runs without CarPlay; zero across all three CarPlay runs.

In both cases the number was typed on a keypad. But ContactSearchManager only fires for entry through the phone app on the device. Typed on the CarPlay screen, the number still reaches CommCenter and kPhoneNumber is identical, but no search chain appears.

Interpretation: The chain records entry on the handset, not entry in general. Its presence places typing on the device. Its absence means another surface, here the car screen. The presence is solid evidence; the absence on its own only rules out the on-device keypad, since a contact, Recents or Siri bypass it too and were not tested.

Watch out – Parsing traps

The executeTransaction blocks are multi-line. Only the header carries a timestamp, process and subsystem; kPhoneNumbersits on an indented continuation line with no metadata. Pre-filtering an export on ^2026- throws those lines away and the number disappears, with no error.

The header is also not always directly above the block. The log is chronological, not grouped per process, so a line from another process can sit between header and body. Anchor on kPhoneNumber and work back, not on the header line.

Conclusion

The dialled number is recorded in plain text in kPhoneNumber, under com.apple.CommCenter:call.provider. kUuid ties setup to teardown and separates a connected call from a failed attempt. ContactSearchManager, when present, reconstructs the typing and places entry on the device itself.

Each artefact is useful on its own. Together they let you reconstruct not just which number was dialled, but whether the call connected and where it was entered. As always: pull the log yourself and confirm the number against the source. The tool is a presentation. The log is the evidence.

Open points

Whether kPhoneNumber stays unredacted for Siri, contact or Recents dialling, or incoming calls. All runs are manual keypad entry. Retention in the ring buffer not established; logs pulled within minutes. Wireless CarPlay not tested.

Six recordings, one device, one iOS version, one head unit. A starting point for your own control measurements, not settled platform behaviour.

More coming soon.

© 2026 Tim Korver — Thesis Friday. Licensed under CC BY-NC-ND 4.0. Method: Anchored Log Reconstruction (ALR). Commercial or training use requires written permission. See Copyright and Use.