Logs Unite: Forensic Analysis of Apple Unified Logs

Sarah Edwards (PDF via Howard Oakley). Of particular note, regarding Console:

If reviewing on live system

• Will only show new new events since Console.app opened.
• Will show messages on disk & in memory (‘Volatile’ column).

Previously: Sierra Logging Spew, Sierra Log Littering.

Console iOS iOS 10 Mac macOS 10.12 Sierra os_log

1 Comment RSS · Twitter

Leave a Comment