The Power of Powerlogs

Sarah Edwards introduces Apple's Powerlogs, a large SQLite database that is not part of a normal device backup but can be extracted from a sysdiagnose archive on iPhone, iPad, Mac, Apple TV, HomePod and Vision Pro. Most tables keep roughly three days of data, so she stresses collecting the sysdiagnose as early as possible in an investigation.

The middle of the talk walks through example tables. These cover frontmost and screen-state app usage, location-related and time zone records, CarPlay connections and screen mirroring, Apple Wallet transaction timing, call status and call service, aggregate app runtime, now-playing and audio routing state, network byte counts, hotspot and airplane mode changes, boot and configuration data, and notification activity tied to Apple Intelligence. Examples come from the speaker's own devices and a recent trip, with timestamps normalized to local time. The main caveat is timestamp drift. Many tables store values that must be corrected through a separate time offset table, which can shift results by seconds or by much longer, so raw timestamps can mislead an examiner.

The closing takeaway is that examiners should understand how each table's timing works before relying on it, and should explore the populated tables on their own devices, since many tables remain poorly documented. Audience questions covered whether turning off location services stops entries from being written, which the speaker had not tested, and whether audio or video activity appears. Media is recorded only as state changes rather than content, and precise coordinates are not stored in this database.