🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.

If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.

Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather Charpentier

Read the blog post here:

https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html

#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics

Hey #iosforensics pals - is there a way to perform a physical acquisition of an iPhone without using any specialist commercial software?

I'd love to extend my research beyond the iPhone backup, but don't have access to any of the fancy ($$$) tools. 😢

You after taking the IACIS Advanced Mobile Device Forensics course.

#DigitalForensics #MobileForensics #DFIR #iOSForensics #iOS

📖 Teaching SEGB v1 & v2 files today.

#DFIR #DigitalForensics #MobileForensics #iOSForensics #iOS

🚨 The SEGB file format is a key data recovery source on devices that run iOS and macOS. SEGB version 2 comes in the most recent operating system implementations.

🔬 Understand the file format: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/

📄 Parse the file format using Python: https://github.com/cclgroupltd/ccl-segb

#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR

🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.

📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.

🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.

ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.

📎 Get the code here: https://github.com/cclgroupltd/ccl-segb

📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/

#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR