Unraveling Time: Understanding Time Formats in iOS Sysdiagnose for Sec Forensics

The talk starts from a forensic problem: when a device may have been tampered with, investigators need exact times to work out when file changes and compromises happened. The speaker shows how a sysdiagnose archive is generated on an iPhone by pressing a button combination, then how it appears under the privacy and analytics settings. The files inside it do not share one layout, and they often use different time representations.

The middle section surveys the formats seen across these files, including UTC offsets, several ISO 8601 variants, RFC 3339, Unix epoch values, and some unusual weekday, month and year strings. Some files mix formats within a single document. Using a flight from Germany to Ireland as the example, the speaker shows how a time zone change is recorded in the logs and how comparing timestamps across several files narrows the moment of the change. The plist data brings the gap down to about ten seconds, while baseband logs, which record several entries per second, give the most precise view when they are available.

The closing takeaway is that baseband logs are the most precise source but expire after about 21 days unless enabled manually. For everyday analysis, the plist, the system logging daemon logs, and the log data statistics file hold the most useful time information, with app conduit and mobile activation logs as supporting evidence.