Sysdiagnose on Shindan - A Mobile forensic project by RandoriSec

Introduction

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

Sysdiagnose #

Introduction #

Sysdiagnose is a utility on most Apple devices that can be used to gather system-wide diagnostic information. It includes logging from different services and reports on the state of systems. What is contained in a sysdiagnose will vary depending on what type of device and which version of the macOS, iOS, iPadOS, tvOS and watchOS.

What do you get? #

Among the tools which have been run, and whose output has been collected for you may consist of the following:

com.apple.networkextension.plist

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

com.apple.networkextension.plist #

 relative_path = "logs/Networking/com.apple.networkextension.plist"

This file contains informations about iOS network extension encluding for exemple vpn configured on the device.

com.apple.wifi.known-networks.plist

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

lockdownd.log

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

MCSettingsEvents.plist

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

MCSettingsEvents.plist #

 relative_path = "logs/MCState/Shared/MCSettingsEvents.plist"

MC stands for Managed Configurations. This file contains logs of settings changes.

Should be monitored.

mobileinstallation.log

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

mobileinstallation.log #

 relative_path = "logs/MobileInstallation/mobile_installation.log.{number}"

 relative_path = "logs/MobileInstallation/mobile_installation_helper.log.{number}"

mobileinstallation.log are plaintext files, accompanied with _helper files.

It has information about the apps installed in the last ~4 days.

PowerLogs

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

Unified logs

contact@shindan.io — Mon, 01 Jan 0001 00:00:00 +0000

Unified logs #

 relative_path = "system_logs.logarchive/*"

Unified logs is a specific Apple log format.