Apple System Log (ASL)
| Format | Apple System Log (ASL) |
|---|---|
| Short name | ASL |
| Category | log |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The binary Apple System Log database format used by Mac OS X/macOS up to 10.11 and by early iOS versions. On macOS, persistent ASL databases are commonly found below /private/var/log/asl/. Records can contain timestamps, host, sender, facility, process ID, user/group IDs, severity level and message text, together with additional free-form key-value attributes. ASL can preserve valuable historical evidence of system, application and security-related activity, including events that are no longer reflected in the current system state. Retention is controlled by the ASL configuration (/etc/asl.conf and /etc/asl/), which often keeps only a limited period; missing time ranges may therefore reflect rotation rather than inactivity. Starting with macOS 10.12, Apple superseded ASL with the Unified Logging system, although legacy ASL databases and ASL-compatible logging may still be encountered on later systems.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 53 4C 20 44 42 00 00 00 00 00 00 | ASL DB...... | ASL database signature |
Known extensions
.asl
References
- Apple System Log (ASL) file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Apple%20System%20Log%20(ASL)%20file%20format.asciidoc
Cite this entry
Crush Format Reference, “Apple System Log (ASL)”. https://kalink0.github.io/crush-forensics/formats/asl/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction