Crush — Format Reference

Apple Unified Log Archive (logarchive)

Forensic relevance

Packaged Apple Unified Log bundle containing tracev3 binary log files, uuidtext string catalogs, timesync boot-anchor records, and a DSC directory. Produced by 'log collect' on macOS/iOS or assembled from a full iOS filesystem acquisition (/private/var/db/diagnostics/ + /private/var/db/uuidtext/ siblings). Provides a complete, timestamp-anchored log timeline with resolved process names, subsystems, and categories; how far back it reaches depends on log volume, as storage is limited by size rather than by a fixed period. Key forensic artifacts: app launches and terminations, lock/unlock and screen events, network connections, Siri activations, biometric authentication attempts, USB/external media connections, userActionEvent entries (explicit user interactions), lossEvent entries (log buffer overflow gaps), and crash precursors. Values logged as private are redacted at write time (masked or hashed) unless private-data logging was enabled; a binary acquisition does not recover them. Full string resolution requires uuidtext/, timesync/, and DSC — without them, message text falls back to raw format-string fragments.

Signatures

None recorded

Known extensions

.logarchive

References

• Apple OSLog documentation https://developer.apple.com/documentation/oslog
• Mandiant macos-UnifiedLogs parser https://github.com/mandiant/macos-UnifiedLogs
• iOS Unified Logs research (ios-unifiedlogs.com, Lionel Notari) https://www.ios-unifiedlogs.com/
• Thesis Friday — Unified Log analysis series (Tim Korver) https://thesisfriday.com/
• Reviewing macOS Unified Logs (Mandiant, Alexander Holcomb, 2022) https://cloud.google.com/blog/topics/threat-intelligence/reviewing-macos-unified-logs/
• Logs Unite! — forensic analysis of Apple Unified Logs (Sarah Edwards) https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf
• Apple Unified Logging and Activity Tracing formats (libyal, Joachim Metz) https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Unified%20Logging%20and%20Activity%20Tracing%20formats.asciidoc

Cite this entry

Crush Format Reference, “Apple Unified Log Archive (logarchive)”. https://kalink0.github.io/crush-forensics/formats/logarchive/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction