#OOTB2025BKK - The Power Of Powerlogs

## Apple Powerlogs Overview

Sarah Edwards of iVerify presents "The Power of Powerlogs" at Hack in the Box Bangkok, exploring Apple's Powerlog database—a rich telemetry source for digital forensics and incident response on macOS, iOS, and related devices. Though her day job focuses on mobile EDR against mercenary spyware like Pegasus, this talk targets DFIR practitioners.

## Where Powerlogs Live

Powerlogs reside under BatteryLife directories on Mac and iOS filesystems. Current logs are actively written; archived copies may appear depending on acquisition method, offering days of historical device-activity data often overlooked in investigations.

## Forensic Value

The database records application usage, screen state, connectivity, and peripheral interactions at granular timestamps. Edwards demonstrates correlating user behavior, background process activity, and system events—material that can substantiate or refute alibis, timeline reconstruction, and compromise indicators on Apple ecosystems.

## Collection Requirements

macOS, iOS, and visionOS support stock-device collection; Apple TV, HomePod, and Apple Watch may need developer profiles installed via paired devices. Edwards references sysdiagnose bundles containing complementary debug artifacts. The database's depth warrants dedicated study beyond a single conference session.