Key finding
The cheatsheet separates four levels at which one USB cable is written: kernel, host type, session and power state. They give four different counts.
tapToWake alone is not a touch. It also appears in ProximitySensor as a mode label.
A single edge-touch line is not a swipe. A real swipe gives nine to twenty-three.
A pick-up of the phone is written by three processes. A count gives three times the number of events.
Part of the Anchored Log Reconstruction series. Follow-up to #30.
#30 ended on known and unknown traces. Once you have a list of known traces, the next risk is the list itself. A search term that gives a hit feels like a finding. #22 ranks evidence by strength, and the same rule applies to a single line: ask what it can prove before you ask what it matches.
The cheatsheet I sent to Alexis Brignoni contains terms that give a hit and mislead. I grouped them by how they mislead.
The term means something else
| Search term | Looks like | What it is | Do this instead |
|---|---|---|---|
tapToWake | A touch that woke the screen. | Also appears in ProximitySensor as a mode label. | Search received tapToWake, send tapToWake or tapToWakeDidRecognize and read the process. |
SBSOSClawGestureObserver | An emergency call gesture. | Appears on every button press. | Use SOS button gesture: press type= from SpringBoard buttons:Combo. The codes are 102, 103 and 104. |
SS disabled: YES, reason: SOSTriggered | An SOS trigger. | Also appears when the power-off menu is opened. | Do not read it alone. Combine it with the button combination line. |
One line, more than one cause
| Search term | Looks like | What it is | Do this instead |
|---|---|---|---|
success=YES | A passcode unlock. | Also fires on a rejected passcode and on Face ID. | Read the cluster around the line, not the line. |
Transition: locked -> unlocked | One unlock. | Counts processes: three to five per unlock, sometimes with different text. It is absent on a biometric unlock. | Count at the kernel endpoint is now UN-locked: two lines per unlock on iOS, three on macOS. |
Gesture notification: 1(Detected) | One pick-up of the phone. | Written by three processes. | Choose one process, or count at the kernel line [TTW] Orientation changed. |
The line is a step around the event
| Search term | Looks like | What it is | Do this instead |
|---|---|---|---|
Prewarming | An app launch. | Preparation. A prewarmed app is not a launched app. | Count on Launching application. |
Touch entered | Where the finger was. | The rectangle in the line is the screen size, not the position of the finger. | Treat it as a touch, not as a location. |
One system gesture stealing the touches line | A swipe. | An edge touch. A real swipe gives nine to twenty-three. | Count the lines in the window before you call it a swipe. |
FD Distance 0 | A Face ID attempt. | Means no detection. The line alone is not a match. | Read it with the biometric match result in the same cluster. |
A zero is not an absence
| Search term | Looks like | What it is | Do this instead |
|---|---|---|---|
HIDEvent Power HIDEvent Volume homeButton | The button was not pressed. | Zero hits on iOS 18.2.1 and 26, because those terms do not occur there. | Search the backboardd Button lines, such as VolumeIncrement. |
SpringBoard / CoreMotion (iOS 12 name) | No rotation happened. | Zero hits on iOS 26. The line has another name there. | Search Received orientation. and check the process name per version. |
What this does to a conclusion
A conclusion that rests on a single hit rests on a string. Rank the line first: what is the strongest thing it can prove, and what would also produce it? Then look for a second line from a different process, as #22 describes. The cheatsheet gives, per term, a reason to doubt it and a search that fits better. I recorded the check so a later zero can be read as a zero.
Limits and version notice
These are search terms with notes, not interpretations of a whole event. The list holds the misleading terms I met on my own reference devices. It is not complete. [List the builds per row. #14 was tested on iOS 18.5, which the cheatsheet does not list.]
Apple changes what it logs between versions of iOS, iPadOS, macOS and watchOS, including in minor updates and betas. A term can change, move to another process or subsystem, or stop being written at all. A message that is absent on one version can appear on the next. Do not carry a row over to another version without a new reference action, and record the device, the build and the acquisition method for every search you run.
Send me an artifact
Is an artifact missing, does a term mislead, or does it no longer work on a newer version? Send it to tim@thesisfriday.com. Include the device model, the OS version and build, the exact action you performed with the time and the clock you read it from, the raw log lines, and how you acquired the log. Do not send case data. Contributions are checked against a reference action before they are added, and accepted ones are credited by name unless you ask otherwise.
Copyright and use
The cheatsheet is licensed under CC BY-NC-ND 4.0. You may share it unchanged and for non-commercial purposes. Name the author (Tim Korver), the source (thesisfriday.com) and the license whenever you use it in public, including in presentations, courses, articles, tool documentation and repositories. Do not place it behind a paywall, a login or a paid course. Commercial use requires written permission via tim@thesisfriday.com.
#DigitalForensics #DFIR #iOSForensics #AppleUnifiedLog