Lionel Notari
9 sept. 2024
The iOS Unified Logs allow digital investigators to show when the user touched the iPhone screen
Week nº 2
The iOS Unified Logs save your touches on the screen. Find below the logs you should investigate!
(iOS 16, 17 and 18) backboardd: Info: notify client com.apple.siri.AttentionAwareness.Touch of <AWDigitizerButtonKeyboardAttentionEvent: 0xda4314dc0> (timestamp: 20742.84002 sender 4343658944
(iOS 16, 17 and 18) AccessibilityUIServer: [PHOENIX] -[AXPhoenixMitigator setTouchOn:] TouchOn: 0 -> 1 (gained 20742.840883291, lost 20458.146434291)
(iOS 16, 17 and 18) AccessibilityUIServer: [PHOENIX] -[AXPhoenixMitigator setTouchOn:] TouchOn: 1 -> 0 (gained 20742.840883291, lost 20742.873444375)
(iOS 16, 17 and 18) backboardd: contact 1 presence: touching
(iOS 16, 17 and 18) backboardd: contact 1 presence: none
(iOS 16, 17 and 18): backboardd: touchstats 1000007AC-<main> events starting 29.1633s ago: [
down: 21,
up: 21,
rangeIn: 21,
rangeOut: 21,
pathsSeen: 1 2 3 4 5 6,
destinations: {
Preferences.317 contextID 1B7DD3B2: {
touchIDs: 133-134;
};
Preferences.317 contextID E49FC416: {
touchIDs: 135-137;
};
WhatsApp.320 contextID 2F272942: {
touchIDs: 124-129;
};
SpringBoard.34 contextID 20646DE2: {
touchIDs: 123 12A-12B 130-132;
};
MobileSafari.971 contextID B38B8F20: {
touchIDs: 12C-12F;
};
},
averageProcessingTime (µs): 1150.55
A few important information
“TouchEvents” and ‘AttentionAwarness’ are two categories of logs I recommend investigating for touch screens.
The first and third logs give the touch timestamp (20742.84) and the third also gives the "release" timestamp (20742.87). These timestamps, in "seconds since last boot", are reset when the device reboot.
The second log gives the interval, in seconds, during which no touching occurred. Here, between 20458.14 and 20742.84 (~ 284 seconds) the user did not touch the screen.
The number between “contact” and “presence” in the fourth and fifth logs is between 1 and 6 and is the same in the “Touching” and “None” logs. "None" corresponds to the moment when the user lifted his finger.
The last log, “touchstats”, shows the number of touches in approx. 30-second interval (29.16 here). It also mentions in which application the touches were made, and the touchIDs allow you to reconstruct the order of touches made by the user. Here, there were 21 touches in "Settings" (5 touches), "WhatsApp" (6), "Safari" (4) and "SpringBoard" (6).