Using Apple Sysdiagnose For Mobile Forensics & Integrity Checks

The talk asks how an iPhone can be checked for compromise without jailbreaking it, since a jailbreak may itself change the evidence. The presenters turn to sysdiagnose, a diagnostic archive that Apple builds into every iOS and iPadOS device for troubleshooting. It is triggered by a button combination and stored under analytics data as a compressed archive of command output, logs, preferences, network records and process information. Much of it is binary, and timestamps mix several epoch formats, which makes it hard to read directly.

To make the archive usable, the team built an open-source, modular framework in the style of Volatility. Parsers normalise individual artifacts, analyzers work on parser output, and a timeline exporter feeds Timesketch. Two demonstrations followed: a Wi-Fi network from a known location appeared in the device history at an implausible place, and an unexpected app was dated from its install record, with a process command line that looked like a reverse shell.

The speakers were candid about limits. The archive holds no private user data such as messages or SMS, so attacks delivered through those channels leave no trace there, and modified system binaries could distort the output. Apple does not document the format, which shifts between iOS versions, so parsers need constant upkeep. They position the tool as a low-impact first check before a full backup, and invited testing on images and contributions. The takeaway is useful triage rather than proof that a device is clean.