Lockdown Mode, passkey, shortcut and VPN log lines

Summary

The pull request adds four small artifacts to iLEAPP's logarchive module. Each reads one literal line from the unified log: the Lockdown Mode flag that Photos prints, the number of passkey records Safari's saved account store loaded, telemetry signposts of the background shortcut runner, and the VPN connectivity state word. Each description says what a line establishes and what it does not.

The four share a pattern that runs through the Lab's research: most controls leave a trace, and few record a change. On the research logs the Lockdown Mode flag read NO on every line, and a VPN state line never named a VPN. A row is an indicator, and it does not prove that a control was on, used or changed.

The issue

An examiner is asked whether Lockdown Mode was on, whether a VPN was in use, whether a shortcut ran in the background, or whether passkeys were loaded. A search of the unified log for “lockdown” looks promising and misleads. It finds an unrelated service, a line from the telephony side that prints <private> in place of the value, and, in one place, a line that prints the value (Figure 1). That last line is the Photos check for Shared Albums. It prints isLockdownMode: followed by YES or NO each time the check runs.

The line is a status, not an event. In the research logs it read NO every time: 1, 2 and 8 lines on three captures, and 0 lines on five public-corpus images. No log from a device with the mode turned on was available, so what the YES form looks like is unverified. A NO line says the mode was off when the line was written. It says nothing about the hours between lines, and a day without a line says nothing about the feature, because a line exists only when the code that prints it ran.

The same care applies to the other three lines. A passkey count is not a list of passkeys. A shortcut signpost is not proof that a shortcut finished. A Disconnected VPN line names no VPN.

The essence

Four thin artifacts read the collected table like the existing ones. Each marker combines a subsystem with literal text, and each row is a log line with its standard columns. Nothing is interpreted. The table lists what each one saw on the research logs.

Markers that no log supported were left out: Stolen Device Protection, NFC and Apple Pay events, and foreground Shortcuts runs had none in the available logs.

Our methodology

Finding the markers. Each marker was taken from decoded sysdiagnose logs as literal text inside a named subsystem (Figure 2), and added to the collection step as well as to the artifact, so the rows reach the table the artifact reads.

Checking the counts twice. The tool was run on the three sysdiagnoses with the real ileapp.py, which imported about 25 to 72 million log records per archive. Separate code, with no iLEAPP in it, ran the same decoder on the same archives and applied the marker conditions to its output. It gave the same twelve numbers and the same VPN split (Figure 3). The numbers in sample_data and the notes were re-derived from the finished runs.

A correction made on the way. The first draft of the VPN notes said every line was Disconnected. The third capture showed Connecting and Disconnecting lines, and the notes were corrected. The repository's output checker also listed columns that held one value on every row, such as subsystem, and an empty category for the VPN artifact. Each is named in the notes, so a reader does not mistake a constant column for a finding.

Synthetic tests and scope. Seven tests run the chain on a synthetic export and check that each artifact returns exactly the expected lines and that every pattern it reads is collected. No test case file was added, because the artifacts read a table the case harness does not build. What was not verified is stated in the pull request: the YES Lockdown form, the Connected VPN state on these captures, foreground Shortcuts runs, other iOS versions, and logs reached by full file system extraction.

The value

Who benefits. Examiners who need a time-stamped line about one of these controls, and researchers comparing what a build prints.

Which question can now be answered. “What did the log print about this control, and when?” The answer is a last known value with a validity window: valid from the first to the last line that restates it, unknown outside the log's window, and a change only somewhere in the gap before the next value (Figure 4). A tunnel that logs Connecting and Disconnecting lines shows more than a device that logs only Disconnected, and neither names a VPN.

What it changes in a case. It stops two mistakes. One is reading a restated status as an event. The other is reading an absent line as an absent control. Where an examiner needs the setting itself, a file in the same extraction may hold it, and the Lab's file-side map says how.

Limits. Only the direct tracev3 import was tested. A VPN line was seen as Connected on a public-corpus image whose device had a VPN configured, but not on the three main captures. Counts depend on how the device was used and on the log window.

Where this sits in the Lab's research

This contribution supports Lab Technical Report LAB-TR-0012, “What the iOS Unified Log Says About Device Security Controls: Most Leave a Trace, Few Record a Change” (preprint, not peer reviewed; available on this site, Zenodo deposit pending, so there is no DOI yet). The report includes these four families in Table 6 with the same counts. It records Lockdown Mode as only ever restated as off, notes that the VPN state never read Connected in the three iOS 26 sysdiagnoses while its iOS 27.0 log held 1,121 lines with 5 Connected, and states the reading rule behind Figure 4 in its Section 6.1.

The white paper LAB-TR-0017 (preprint on this site; Zenodo deposit pending) is the file-side companion: it found the Lockdown Mode key in 5 of 33 global preference files and says a reader should report “key absent”, not “off”. LAB-TR-0013 (preprint on this site; Zenodo deposit pending) measured a related point for messages: the log named about a quarter of recent messages, so a missing line says little. It does not concern these controls.

Sources

Every number in this post is listed here with where it comes from. Figures use these numbers or invented example values, marked as such.

Related posts