Lost in the Logs: Navigating the Binary Format of the Apple-Unified Log

The Apple Unified Log has become a critical forensic artifact that DFIR analysts leverage when investigating compromised Apple devices. However, the binary structure format of the Unified Log is undocumented by Apple and remains a black box for many analysts and users. This forces analysts to rely on native Apple tooling. To better understand how a log message is assembled, we must understand how the log message is reconstructed from fragmented data across a system. This talk will be a deep dive into the binary structure of the Apple Unified Log format and a walkthrough of the three binary components of the Unified Log. We will discuss each binary file format and how each component leverages each other in order to assemble a full log message. In addition, the talk will discuss some challenges that may be encountered when parsing the log formats. Finally this talk will discuss a cross-platform, open-source Rust library designed to parse the Apple Unified Log files.