iOS Crash Report

Format	iOS Crash Report
Short name	IPS / crash
Category	log
Platforms	macOS, iOS
Crush support	Not yet supported
Status	Reviewed
Last reviewed	2026-10-04

Forensic relevance

Application and system crash reports generated by iOS and macOS. Two formats: the newer .ips format (iOS 15+ / macOS 12+, JSON-based with bug_type field — value 309 indicates a crash report) and the older .crash format (plain text). Each report contains: app name, bundle ID and version, iOS/macOS version, device model, an anonymised per-device identifier (CrashReporter Key, reset when the device is erased), incident UUID, process launch time, precise crash timestamp, exception type and reason, and thread states with stack traces. Forensically relevant for: establishing a precise timeline of app crashes, identifying exploitation attempts or repeated crashes of security-relevant apps, detecting jailbreak-related crashes, and corroborating user activity. Stored on iOS under /var/mobile/Library/Logs/CrashReporter/ (accessible via Settings → Privacy (& Security) → Analytics & Improvements → Analytics Data) and on macOS under ~/Library/Logs/DiagnosticReports/ and /Library/Logs/DiagnosticReports/.

Signatures

None recorded

Known extensions

.ips, .crash

References

Apple developer docs — examining crash report fields https://developer.apple.com/documentation/xcode/examining-the-fields-in-a-crash-report
Apple developer docs — interpreting JSON crash report format https://developer.apple.com/documentation/xcode/interpreting-the-json-format-of-a-crash-report
iOS crash logs forensics (ArtiFast / forensafe.com) https://forensafe.com/blogs/AppleCrashLogs.html

Cite this entry

Crush Format Reference, “iOS Crash Report”. https://kalink0.github.io/crush-forensics/formats/ips-crash/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction