#iosforensics — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #iosforensics, aggregated by home.social.
-
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.
34 artifacts, 230 predicates. Calls, typing, Face ID and Touch ID frames, touch contact, pocket state, camera, AirDrop, Bluetooth pairing, driving state.
Each one is documented in published research, observed on real iOS 16.5/17.1/18.7 extractions, or both. The guide says which, per pattern, and what did not make the cut.
Free, PDF included.
https://leapps.org/blog-post?post=2026-08-01-unified-log-predicate-reference
-
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.
34 artifacts, 230 predicates. Calls, typing, Face ID and Touch ID frames, touch contact, pocket state, camera, AirDrop, Bluetooth pairing, driving state.
Each one is documented in published research, observed on real iOS 16.5/17.1/18.7 extractions, or both. The guide says which, per pattern, and what did not make the cut.
Free, PDF included.
https://leapps.org/blog-post?post=2026-08-01-unified-log-predicate-reference
-
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.
34 artifacts, 230 predicates. Calls, typing, Face ID and Touch ID frames, touch contact, pocket state, camera, AirDrop, Bluetooth pairing, driving state.
Each one is documented in published research, observed on real iOS 16.5/17.1/18.7 extractions, or both. The guide says which, per pattern, and what did not make the cut.
Free, PDF included.
https://leapps.org/blog-post?post=2026-08-01-unified-log-predicate-reference
-
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.
34 artifacts, 230 predicates. Calls, typing, Face ID and Touch ID frames, touch contact, pocket state, camera, AirDrop, Bluetooth pairing, driving state.
Each one is documented in published research, observed on real iOS 16.5/17.1/18.7 extractions, or both. The guide says which, per pattern, and what did not make the cut.
Free, PDF included.
https://leapps.org/blog-post?post=2026-08-01-unified-log-predicate-reference
-
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.
34 artifacts, 230 predicates. Calls, typing, Face ID and Touch ID frames, touch contact, pocket state, camera, AirDrop, Bluetooth pairing, driving state.
Each one is documented in published research, observed on real iOS 16.5/17.1/18.7 extractions, or both. The guide says which, per pattern, and what did not make the cut.
Free, PDF included.
https://leapps.org/blog-post?post=2026-08-01-unified-log-predicate-reference
-
Apple Unified Logs are no longer an edge-case data source.
🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 NavigationMy updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.
Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs -
Apple Unified Logs are no longer an edge-case data source.
🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 NavigationMy updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.
Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs -
Apple Unified Logs are no longer an edge-case data source.
🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 NavigationMy updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.
Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs -
Apple Unified Logs are no longer an edge-case data source.
🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 NavigationMy updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.
Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs -
Apple Unified Logs are no longer an edge-case data source.
🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 NavigationMy updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.
Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs -
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.
Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather CharpentierRead the blog post here:
https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html
#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics -
🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.
Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather CharpentierRead the blog post here:
https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html
#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics -
🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.
Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather CharpentierRead the blog post here:
https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html
#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics -
🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.
Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather CharpentierRead the blog post here:
https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html
#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics -
🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.
Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather CharpentierRead the blog post here:
https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html
#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics -
Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?
I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢
-
Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?
I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢
-
Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?
I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢
-
Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?
I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢
-
Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?
I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢
-
You after taking the IACIS Advanced Mobile Device Forensics course.
-
You after taking the IACIS Advanced Mobile Device Forensics course.
-
You after taking the IACIS Advanced Mobile Device Forensics course.
-
You after taking the IACIS Advanced Mobile Device Forensics course.
-
You after taking the IACIS Advanced Mobile Device Forensics course.
-
📖 Teaching SEGB v1 & v2 files today.
-
📖 Teaching SEGB v1 & v2 files today.
-
📖 Teaching SEGB v1 & v2 files today.
-
📖 Teaching SEGB v1 & v2 files today.
-
📖 Teaching SEGB v1 & v2 files today.
-
🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.
🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.
🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.
🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.
🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.
🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.
📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.
🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.
ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.
📎 Get the code here: https://github.com/cclgroupltd/ccl-segb
📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.
📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.
🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.
ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.
📎 Get the code here: https://github.com/cclgroupltd/ccl-segb
📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.
📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.
🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.
ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.
📎 Get the code here: https://github.com/cclgroupltd/ccl-segb
📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.
📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.
🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.
ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.
📎 Get the code here: https://github.com/cclgroupltd/ccl-segb
📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR
-
🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.
📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.
🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.
ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.
📎 Get the code here: https://github.com/cclgroupltd/ccl-segb
📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/
#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR