Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
Back in May 2019, along with my colleagues Heather Mahalik and Adrian Leong, we wrote the paper " Using Apple “Bug Reporting” for forensic purposes " and some scripts to parse data stored in Sysdiagnose logs. The paper is still available for download and, for the most part, is still accurate. But time goes on, and new iOS versions have come on the market in recent years. I took a first look at a sysdiagnose generated on a freshly wiped iPhone with iOS 16 natively installed. For sysdiagnose generation and extraction, nothing has changed since our paper. You can still generate it in a hardware or software way, and you can extract it with forensic tools (i.e. Elcomsoft iOS Forensic Toolkit ) or with iOS device manager tools (i.e. 3uTools ). Once extracted, the sysdiagnose is a TAR file that contains various files in the root folder and different subfolders. At first look, most of the files seem coherent with what we wrote in the paper. You can in fact find: sysdiagnose.log tas...