Apple Unified Log (tracev3)
| Format | Apple Unified Log (tracev3) |
|---|---|
| Short name | tracev3 |
| Category | log |
| Platforms | macOS, iOS |
| Crush support | Supported (UnifiedLogConverter) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Binary log file format used by Apple's Unified Logging System. Individual .tracev3 files are stored under /private/var/db/diagnostics/ in Persist/, Special/, Signpost/, and HighVolume/ subdirectories, plus logdata.LiveData.tracev3 at its root. Each file is a sequence of chunks — a header, catalogs and LZ4-compressed chunksets holding the timestamped log entries — referencing format strings via uuidtext/ catalogs and the Dyld Shared Cache (DSC). Cannot be parsed in isolation — requires companion uuidtext/, timesync/, and DSC directories for full string resolution and timestamp anchoring. See the Apple Unified Log Archive (logarchive) entry for full forensic context and artifact categories.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 00 10 00 00 11 00 00 00 | ........ | Header chunk: tag 0x1000, sub tag 0x11 (little-endian) |
Known extensions
.tracev3
References
- Apple Unified Logging formats — tracev3 internals (libyal) https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Unified%20Logging%20and%20Activity%20Tracing%20formats.asciidoc
- Mandiant macos-UnifiedLogs parser https://github.com/mandiant/macos-UnifiedLogs
- iOS Unified Logs research (Lionel Notari, ios-unifiedlogs.com) https://www.ios-unifiedlogs.com/
- Thesis Friday — Unified Log analysis series (Tim Korver) https://thesisfriday.com/
Cite this entry
Crush Format Reference, “Apple Unified Log (tracev3)”. https://kalink0.github.io/crush-forensics/formats/tracev3/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction