MOBILE FORENSICS

iOS logs and system logs

Modern iPhones generate numerous system logs, which may contain information about system events, applications and operating states. In the context of an IT forensic investigation, these logs often provide a valuable supplement to traditional user artefacts.

Unified Logs
Crash logs
Diagnostic and analysis reports
Log archives
Kernel and system events
App-related logs
Timestamps and event sequences

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the iOS version and the data source, the following logs, amongst others, can be analysed:

  • •Unified Logs
  • •Crash logs
  • •Diagnostic and analysis reports
  • •Log archives
  • •Kernel and system events
  • •App-related logs
  • •Timestamps and event sequences

This information can help to place technical processes in a chronological context and to document any anomalies in a way that is easy to follow.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Depending on the device, iOS version and backup method, the available logs are analysed in a structured manner. Relevant entries are correlated with other artefacts in order to present technical relationships in a clear and comprehensible way. Automated analyses are always supplemented by a manual plausibility check.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which events were logged?
  • ✔Can app crashes be traced?
  • ✔Is it possible to determine the times at which certain activities take place?
  • ✔Which system events are documented?
  • ✔How reliable are the existing logs?

LIMITATIONS & CONCLUSION

What you should know

Not all events are logged permanently. Depending on the iOS version, storage management and the time period, logs may be overwritten or may no longer be available. The usefulness of the logs therefore always depends on the available data.

System logs often provide valuable additional information for reconstructing technical processes. However, they are always analysed in conjunction with other forensic artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you need a professional analysis of iOS logs, or would you like to have technical processes on an iPhone reconstructed? LanCologne can assist you with an objective IT forensic analysis and comprehensive documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What are unified logs?
The central logging system in current versions of iOS for recording a wide range of system events.
Can crash logs be analysed?
Yes, they often provide clues about system crashes and application errors.
Are all events stored permanently?
No. Many logs are subject to an automatic storage limit.
Are system logs alone sufficient as evidence?
As a rule, they should be assessed alongside other artefacts.
Can an expert report be drawn up?
Yes. The results can be documented in a transparent manner and assessed by experts.