DS-0002

iPhone sysdiagnose-style set

34 reduced sysdiagnose-style folders written by a script, each for a known sequence of actions on an invented phone: an app install, a Wi-Fi join, airplane mode on and off, an app crash and an app removal. Every case has a reference answer, so you can test a reader or a parser against known facts. The values are invented and no file comes from a device.

Built from what the Lab learned on real devices provided to the Lab by partners; every file here is synthetic, so no case data is exposed.

Synthetic filesVersion 1.0Data CC BY 4.0Code MIT

Get the dataset See one case Try the challenge

At a glance
What is inside
Reference answers
One case
Try it
Download and licence
Hashes
Cite

At a glance

What the set is, how it was made, what it is not, and how it may be used.

The unified log is plain text here. A real sysdiagnose holds a tracev3 log archive, which this set does not reproduce. The layout is the iOS 26 one: LAB-TR-0011 reports that iOS 27.0 archives no longer carry the older container-manager and app-installation text logs, and this set does not model iOS 27.

Device class: None (generated files; an invented iPhone model, iPhone99,1)
OS: iOS 26 class layout, invented build SYNTH26A1
Evidence type: Synthetic sysdiagnose-style folders
Made on: A script (generate.py, Python standard library) with seed 20261106. No device, no case data and no real identifiers. The same seed gives the same bytes.
Contents: 34 cases in 7 categories, 175 scripted actions (59 app installs or removals, 27 Wi-Fi joins, 57 airplane mode changes, 32 app crashes). 173 files in the cases, 178 in the zip.
Size: 229 KB as a zip (234,001 bytes)
Version: 1.0
Licence: Data: CC BY 4.0. Generator code: MIT.
Maintainer: Daniel Addai, SectraTEK Lab

What is inside

One folder per case, shaped like a reduced sysdiagnose. Five kinds of file carry the traces. The reference answers sit outside the case folders, so you can run a tool blind and compare after.

One case folder, and the top level of the zip

iphone-sysdiagnose-set/
  README.txt  LICENCE.txt
  reference_answers.json  reference_answers.csv
  generator/generate.py
  cases/
    c027-timezone-offset-01/
      sysdiagnose_2026.02.19_17-02-23-0500_iPhone-OS_iPhone_SYNTH26A1/
        SystemVersion/SystemVersion.plist
        logs/MobileInstallation/mobile_installation.log.0
        WiFi/com.apple.wifi.known-networks.plist
        crashes_and_spins/SynthLedger-2026-02-19-155324.ips
        system_logs_excerpt/unified_log_excerpt.txt
    ... 34 cases in all

Files in each case and what they are modelled on
File	Holds	Modelled on
mobile_installation.log.0	Install, removal, container, patch and reboot lines. Device-local time, no zone marker.	Line shapes matched by the public iLEAPP reader of this log
com.apple.wifi.known-networks.plist	Known networks with added, user-join and system-join dates (UTC). XML property list.	Keys read by the public iLEAPP Wi-Fi reader
*.ips	Crash reports, JSON form: a metadata line, then a body. Time with a UTC offset.	Keys read by the public iLEAPP diagnostic-report reader, and Apple's description of the JSON crash format
unified_log_excerpt.txt	Text lines in the style of `log show`: airplane mode changes, Wi-Fi joins and link loss, install, removal and crash notes, state polls and noise.	Message forms matched by the public iLEAPP log-archive module. The install, removal and crash wording is invented.
SystemVersion.plist	Invented model, OS version and build.	Nothing public is copied

Placement of each file inside the folder is a modelling choice, not a claim about where a phone puts it. The background is deliberate: earlier installs of other apps, a patch-update attempt (not an install), a reboot line, other known networks, an earlier crash of another app in some cases, and 147 airplane mode state polls in the unified-log excerpt that are not toggles. A tool should not report any of these as a scripted action.

Sources for the formats: iLEAPP (MIT), Apple, Interpreting the JSON format of a crash report, iOS Unified Logs: Wi-Fi and airplane mode, Sysdiagnose Analysis Framework, and Lab report LAB-TR-0011.

Reference answers

34 cases in 7 categories. For each case the set holds the files and a record of what was done: every scripted action with its true time and the files where its trace sits, plus what a correct reader should report from each file.

Categories in DS-0002 and the reference answer for each
Category	Cases	Setup	Reference answer	Actions
Full script	6	All six actions in the scripted order: install the app, join a Wi-Fi network, airplane mode on, airplane mode off, app crash, remove the app.	Every action found at its true time, in the files named. After airplane mode goes off the phone joins the known network again by itself (a modelled behaviour).	36
Shuffled order	6	The same six actions in another order. The app is installed before it crashes and crashes before it is removed; airplane mode goes on before it goes off.	The true order and times. Files do not agree on order, so a tool has to sort by time.	36
Subset	6	Two or three of the five steps (install, Wi-Fi join, airplane mode on and off, crash, removal). Airplane mode is sometimes left on at capture. An app not installed by the script has an earlier install line.	Which actions happened and which did not. A tool must not report an action the script never took.	19
Reinstall	4	Install, crash, remove, install again, with a second crash, a Wi-Fi join or an airplane mode cycle in some cases.	Both installs and the removal with times. The last installer-reported outcome is an install, so the app is present at capture.	24
Log starts after the install	4	The app was installed before the retained part of the install log, so the file holds no install line for it. The script crashes the app and does some of the other actions.	The install is not in the file. The app does not appear in the installed list, whatever its removal state. Absence of a line does not show the app was never installed.	12
Device clock not UTC	4	The device clock is UTC-05:00, UTC+05:30, UTC+09:00 or UTC-08:00. The install log and crash file names use device-local time; the Wi-Fi plist holds UTC dates; the log excerpt and crash metadata carry an offset.	Each action in UTC and as written, so a tool that treats every file as UTC is caught.	24
One trace file removed	4	The full script, with one trace file taken out: the Wi-Fi plist, the crash reports, the unified-log excerpt or the install log.	Which actions are still visible through another file and which are not. A missing trace does not prove the action did not happen.	24

The answers are in reference_answers.json (one record per case) and reference_answers.csv (one row per action). Each case record gives the device clock offset, the capture time, the script app, flags, the list of actions (order, action, true time in UTC, detail, and each trace with the file and the time as written), consequences the script caused (a Wi-Fi link loss, an automatic re-join), background events a tool should not report as actions, and expected_reader_output: the installed and removed apps, the Wi-Fi networks, the airplane mode changes and the crash reports a correct reader of the files should list.

Limits. The set has 175 actions of which 2 have no trace left in the folder (the unified-log excerpt removed in one case hides the airplane mode changes). The 18 automatic Wi-Fi re-joins after airplane mode are a modelled behaviour; a real phone may differ. The earlier-crash decoys (9) are crash reports that are not part of the script. A missing trace does not prove that an action did not happen, and a present trace is an indicator, not proof of who did it.

One case, read end to end

Case c027-timezone-offset-01: the full script on a phone whose clock is UTC-05:00. The install log is written in device-local time with no zone marker; the Wi-Fi plist is in UTC; the log excerpt and the crash report carry an offset. The reference answer gives the true UTC time of each action.

Scripted actions for case c027-timezone-offset-01 and where each trace sits
Step	Action	True time (UTC)	First trace, as written	Files
1	Install app com.synthetic.apps.synthledger	2026-02-19 14:51:17	2026-02-19 09:51:17	mobile_installation.log.0, unified_log_excerpt.txt
2	Join Wi-Fi SYNTH-Office-Guest	2026-02-19 15:58:42	2026-02-19 15:58:42 (UTC)	com.apple.wifi.known-networks.plist, unified_log_excerpt.txt
3	Airplane mode on from settings	2026-02-19 18:00:14	2026-02-19 13:00:14.265891-0500	unified_log_excerpt.txt
4	Airplane mode off from settings	2026-02-19 19:51:19	2026-02-19 14:51:19.853376-0500	unified_log_excerpt.txt
5	App crash EXC_BAD_ACCESS, SIGSEGV	2026-02-19 20:53:24	2026-02-19 15:53:24.00 -0500	SynthLedger-2026-02-19-155324.ips, unified_log_excerpt.txt
6	Remove app com.synthetic.apps.synthledger	2026-02-19 21:51:18	2026-02-19 16:51:18	mobile_installation.log.0, unified_log_excerpt.txt

logs/MobileInstallation/mobile_installation.log.0 (lines for the script app)

Thu Feb 19 09:51:14 2026 [0x16b92c210] Installing <MIInstallableBundle ID=com.synthetic.apps.synthledger; Version=100, ShortVersion=1.0.0>
Thu Feb 19 09:51:16 2026 [0x16b368341] Made container live for com.synthetic.apps.synthledger at /private/var/mobile/Containers/Data/Application/189BC55E-FD68-431B-BB6F-F8D4921EBBC7
Thu Feb 19 09:51:16 2026 [0x16b5ec935] Data container for com.synthetic.apps.synthledger is now at /private/var/mobile/Containers/Data/Application/189BC55E-FD68-431B-BB6F-F8D4921EBBC7
Thu Feb 19 09:51:17 2026 [0x16b4a0426] Install successful for (Customer:com.synthetic.apps.synthledger) [Distributor: (null)]
Thu Feb 19 16:51:18 2026 [0x16b7d8121] Uninstalling identifier com.synthetic.apps.synthledger
Thu Feb 19 16:51:19 2026 [0x16bc9d585] Destroying container com.synthetic.apps.synthledger with persona (null) at /private/var/mobile/Containers/Data/Application/189BC55E-FD68-431B-BB6F-F8D4921EBBC7

system_logs_excerpt/unified_log_excerpt.txt (lines for the script actions)

2026-02-19 09:51:17.206307-0500  Df  installd[803:5f5] [com.apple.mobile.installd] Install of com.synthetic.apps.synthledger completed
2026-02-19 10:58:40.702134-0500  Df  wifid[874:7e6] [com.apple.wifi.assoc] __associate Manual Association Request from user for network SYNTH-Office-Guest
2026-02-19 10:58:42.797680-0500  Df  wifid[626:11e] [com.apple.wifi.lqm] WiFiLQAMgrSetCurrentNetwork: Joined SSID: SYNTH-Office-Guest
2026-02-19 13:00:13.567507-0500  Df  Preferences[372:a2c] [com.apple.Preferences] Setting airplane mode to true
2026-02-19 13:00:14.265891-0500  Df  CommCenter[681:29f] [com.apple.telephony] Airplane Mode is now 1
2026-02-19 13:00:15.588922-0500  Df  wifid[636:164] [com.apple.wifi.link] Link went down for network SYNTH-Office-Guest
2026-02-19 13:00:15.926589-0500  Df  wifid[545:ee7] [com.apple.wifi.power] WiFi state changed: off
2026-02-19 14:51:18.688732-0500  Df  Preferences[235:66d] [com.apple.Preferences] Setting airplane mode to false
2026-02-19 14:51:19.853376-0500  Df  CommCenter[701:32b] [com.apple.telephony] Airplane Mode is now 0
2026-02-19 14:51:20.946165-0500  Df  wifid[362:9e6] [com.apple.wifi.power] WiFi state changed: on
2026-02-19 14:51:24.732901-0500  Df  wifid[680:298] [com.apple.wifi.autojoin] {AUTOJOIN, ASSOC*} Attempting auto join association of SYNTH-Office-Guest
2026-02-19 14:51:25.710333-0500  Df  wifid[169:49f] [com.apple.wifi.autojoin] Auto join association succeeded for SYNTH-Office-Guest
2026-02-19 15:53:24.571925-0500  Df  ReportCrash[235:66d] [com.apple.crashreporter] Saved crash report for SynthLedger[2198] version 1.0.0 (100) to SynthLedger-2026-02-19-155324.ips
2026-02-19 16:51:18.404014-0500  Df  installd[410:b36] [com.apple.mobile.installd] Removal of com.synthetic.apps.synthledger completed

What the reference answer says about the airplane mode step

reference_answers.json (excerpt)

{
  "case_id": "c027-timezone-offset-01",
  "device.clock_offset_from_utc": "-05:00",
  "actions[2]": {
    "order": 3,
    "action": "airplane_on",
    "time_utc": "2026-02-19T18:00:14Z",
    "detail": {
      "state": "on",
      "route": "settings"
    },
    "trace_time_as_written": "2026-02-19 13:00:14.265891-0500",
    "trace_file": "system_logs_excerpt/unified_log_excerpt.txt"
  },
  "expected_reader_output.airplane_mode_toggles": [
    {
      "time_utc": "2026-02-19T18:00:14Z",
      "state": "on",
      "route": "settings"
    },
    {
      "time_utc": "2026-02-19T19:51:19Z",
      "state": "off",
      "route": "settings"
    }
  ]
}

The values are invented. The two lines of each airplane mode change come from two processes, and the route (Control Center or Settings) is read from the first of them. The state polls in the same file say isAirplaneMode and are not changes.

Try it with free tools

Python 3 and a plain text editor are enough. Nothing here needs a commercial tool.

Check the download. Compute the SHA-256 of the zip and compare it with the value below: python -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" iphone-sysdiagnose-set-1.0.zip
Unzip it and open one case folder. Do not open reference_answers.json yet.
Read the install log in a text editor. Find the lines with Install successful for, Uninstalling identifier and Destroying container. The last installer-reported outcome for each bundle is its state.
Read the Wi-Fi plist: python -c "import plistlib,sys;print(plistlib.load(open(sys.argv[1],'rb')))" com.apple.wifi.known-networks.plist. Note JoinedByUserAt and JoinedBySystemAt.
Read a crash report. The first line is JSON metadata, the rest is the body. Take captureTime and its offset.
Search the log excerpt for Airplane Mode is now and put every change on one timeline with the rest, converting each file to UTC.
Compare with reference_answers.json: your timeline against actions, your lists against expected_reader_output.
Optional. Point the public iLEAPP at a case folder. The Lab checked its install-log reader and its JSON crash reader against this set, and they agree with the answers for all 34 cases. Its log-archive module needs a tracev3 archive and does not read the text excerpt.

Try the challenge: One question, three evidence sources (Expert).

Get the dataset

One zip, 234,001 bytes. It holds 178 files: the cases, the reference answers, the licences, a short README and the generator. Check it against the hash below.

Download iphone-sysdiagnose-set-1.0.zip (229 KB)

Served from this site, versioned. The manifest and the hashes are linked below.

SHA-256 of the zip

b5b80778861eaeecbeaa894caec8d6b06effdd41787b801c40902e8ee030aee7

The loose files, manifest.json and SHA256SUMS.txt sit beside the zip on this site. To rebuild every byte yourself, run python generate.py from the generator folder (Python 3, standard library only).

Licence

Data: Creative Commons Attribution 4.0 (CC BY 4.0)

A plain-language summary. The full text is at creativecommons.org/licenses/by/4.0 and in LICENCE.txt inside the zip.

You may

copy and share the files in any medium or format;
adapt them, for example to make test fixtures, and use them for any purpose, including teaching, research, casework and commercial work.

You must

give credit, using the citation on this page;
link to the licence and say if you changed the files.

Please also

keep the hashes beside any copy you share, so others can check it;
say that the files are synthetic. Do not present them as taken from a real phone or a real case. They are not.

Code: MIT

generate.py is under the MIT licence. Keep the copyright notice with copies.

The dataset is provided as is, without warranty.

Hashes

Check every file after download. The set hash is the SHA-256 of manifest.json, which lists the size and hash of every other file.

Set hash (SHA-256, manifest.json)

efb13ec545321739ea34d89390e8ef951be9debd8bf3a409d4569d877c4a5568

Files in DS-0002 with SHA-256 hashes
File	Content	Size	SHA-256
iphone-sysdiagnose-set-1.0.zip	Archive	234,001 bytes	b5b80778861eaeecbeaa894caec8d6b06effdd41787b801c40902e8ee030aee7
reference_answers.json	Reference answers	295,068 bytes	2024847eef79b5d98d776a3ab86373b4f646453fa176874b8435308d22ce6a66
reference_answers.csv	Reference answers (one row per action)	40,050 bytes	c487537d90565f10e69620e697f54e572adb1546be8f211ae21eaf68f8645d05
README.txt	Notes	2,561 bytes	0b00a4fd60fb7d202f19fe5899006d569b02ad4a79513eef57dfc067442ff455
LICENCE.txt	Licences	1,431 bytes	1da800f43ffdd97f1d4ea06b23f59c20c7594f539c591ea9aec08cb0cacf5afc
generator/generate.py	Generator (MIT)	37,262 bytes	6590a3be87bbf61beb767fffb4fa0a77e994960da2bc4277387092374f33a8f8
manifest.json	Manifest (file, bytes, SHA-256)	47,420 bytes	efb13ec545321739ea34d89390e8ef951be9debd8bf3a409d4569d877c4a5568
SHA256SUMS.txt	The same hashes in sha256sum format	35,256 bytes	279f90b9eb9e2046dab6e4f4b917a21728e5225b7007f154a93beef7e3ae37b6
cases/ (173 files)	Sysdiagnose-style folders	355,921 bytes	One hash per file in manifest.json and SHA256SUMS.txt

The zip holds the same files as the folder (the zip itself, manifest.json and SHA256SUMS.txt excepted). Together the files are 732,293 bytes before compression. Hashes and sizes on this page are read from manifest.json.

Cite this dataset

Cite as

Addai, D., SectraTEK Lab (2026). iPhone sysdiagnose-style set (DS-0002), version 1.0. SectraTEK Lab Datasets. https://lab.sectratek.com/datasets/iphone-sysdiagnose-set/ SHA-256 of manifest.json efb13ec545321739ea34d89390e8ef951be9debd8bf3a409d4569d877c4a5568

Citation guide

BibTeX

@dataset{sectratek-lab-ds-0002,
  author    = {Addai, Daniel},
  title     = {iPhone sysdiagnose-style set},
  year      = {2026},
  version   = {1.0},
  publisher = {SectraTEK Lab},
  url       = {https://lab.sectratek.com/datasets/iphone-sysdiagnose-set/},
  note      = {DS-0002, SHA-256 of manifest.json efb13ec545321739ea34d89390e8ef951be9debd8bf3a409d4569d877c4a5568}
}

Datasets carry their own licence. This one is CC BY 4.0 for data and MIT for code. Articles are CC BY 4.0. All licences.