When an iPhone behaves strangely, the fastest witness is the phone itself. It keeps a running account of what its software did, which apps asked for what, and where its own components failed, and it can bundle that account into one diagnostic archive: a sysdiagnose. Not every client can bring a phone to a lab, and not every question justifies a full extraction. This is the evidence type that closes that gap. Here is what we find in it, where it stops, and how the result becomes a report your client can act on.
What a sysdiagnose is, and how it is obtained
A sysdiagnose is a single archive that an iPhone or iPad generates about itself on request. It collects the device’s logs, its crash reports and a snapshot of its running state at the moment it was made. It is not a copy of the phone’s contents.
That shape is its first advantage. One file is easy to collect, easy to move and easy to hash. An examiner can generate it from a connected phone, or ask the owner to collect it remotely with SectraTEK Quick Capture, which guides the owner step by step through collecting the files from their own iPhone, iPad or Android phone. For an iPhone, Quick Capture needs iOS 17 or later and checks that Developer Mode is on, showing the steps if it is not.
Once the archive is in hand, SectraTEK picks it in the evidence browser and references it where it is stored. The examination opens it read-only and does not copy it into the product. Before analysis begins, a SHA-256 hash of the evidence is recorded in the case, and a final check near the end confirms the evidence still matches.
What the evidence shows, and what it cannot
We would rather you hear the limits from us. A sysdiagnose records how the phone ran. It does not record what its owner said or saw. There is no message content in it, no photo library, no browsing history and no document store; SectraTEK’s document and attachment examination applies to backups and file systems, not to this evidence. If your question is who did this person write to, this is the wrong evidence. If your question is does this phone show signs of having been tampered with, and what is it exposed to, it is a good place to start.
Two more limits matter, and a defensible report states both.
First, logs cover only the period the device retained. Phones overwrite old log entries, so the archive covers a limited window. SectraTEK’s log-based checks report the period the device retained, so you can state exactly which dates the evidence covers.
Second, some attacks leave little behind. Zero-day and memory-corruption attacks can leave few lasting traces on a device, and a result with no findings is not proof that a device was never attacked. The absence of a log entry is not proof that an event did not happen.
Logs are still a serious witness. According to Citizen Lab (2025), its forensic confirmation of commercial spyware on journalists’ iPhones rested in part on device logs showing requests to a server that matched a known fingerprint[S2].
That was a research lab’s work on specific devices. We cite it to show what logs can hold, not to claim that SectraTEK detects any named product. The scale of the problem is better told by counts. Google’s threat intelligence group counted 15 zero-days exploited in the wild against mobile operating systems in 2025, after 9 in 2024[S1]. Those are floors: only exploitation that was detected and attributed is counted.
Describe this figure
Schematic. On the left, what a sysdiagnose holds: Apple log events, crash reports, running state and privacy-permission records, with message content, photos and browsing history marked as not present. On the right, the four engines that read it: threat intelligence, Insight, permission and access correlation, and vulnerability exposure.
What we look for
The Lab’s work on this evidence type is organized around the questions a client actually asks. Here is what we look for, in plain terms.
Crash and system logs. A sysdiagnose examination reads the crash reports and system logs the device retained and reports the dates they cover. The decoded Apple log events can be searched and filtered by message, date, process, subsystem and category, so an examiner can follow a thread from a lead to the log lines behind it.
Apps, permissions and the access they hold. Each app observed in the archive is brought together with the sensitive capabilities it can reach, including camera and microphone, and shown with the permission state the evidence recorded. Every permission record is tied to its app. Because a diary can mention an app that is no longer there, SectraTEK labels each app by how firmly the evidence supports its installation. A permission record is never passed off as proof of installation, and a recorded permission is never passed off as proof of use.
Known-bad indicators. What the archive contains, such as apps, certificates, files, domains and addresses, is compared with SectraTEK Intelligence, and every exact match is reported. A match arrives with its family and context, so you can weigh it.
Vulnerability exposure. The operating system version recovered from the archive is compared with vendor security releases and known-exploitation context. Exposure and exploitation are kept in separate fields, so a report can say precisely what a phone was open to and what has been seen in the wild.
Leads. Insight looks for activity that does not fit the apps and identities the device records, ranks what it finds, and attaches the evidence behind each lead. A lead is a reason to look closer, not a verdict.
Four of the eight engines read a sysdiagnose: threat intelligence, Insight, permission and access correlation, and vulnerability exposure. The others need evidence a sysdiagnose does not carry, and SectraTEK says so rather than showing an empty result.
Our approach
How SectraTEK approaches this
The Lab applies the same discipline to every evidence type, and it begins with restraint. The evidence stays where it is. The examination makes no outside contact, which keeps results reproducible, and the intelligence it compares against is the installed copy on your own workstation.
Then it asks each check to be honest about itself. Each check reports whether it had the evidence to run, and a check that could not run says so, so a gap is never mistaken for a clean result. Anything that cannot be decided is reported as such, never as clean. A result with no match is reported with the coverage behind it, so you can state exactly what was compared.
Last, it leaves the judgment with the owner. SectraTEK reports what it compared and what matched; the examiner draws the conclusion. Leads are starting points for corroboration, and a sysdiagnose leaves many of them waiting for exactly that.
Describe this figure
Flow in four steps: the sysdiagnose is referenced in place and hashed; four engines read it and each check states whether it had the evidence to run; results are rated Critical, High, Moderate, Low or No match; the AI-Dossier carries the findings, leads, intelligence matches, limits and the integrity record.
From findings to a report you can act on
The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier opens with a readable cover that names the evidence examined, what it can and cannot establish and the key figures of the case.
Ratings are written as words so the page reads the same without color. Critical is the strongest evidence, where you start. High is strong evidence worth immediate review. Moderate is a signal worth a second look. Low is context or ordinary activity, noted for completeness. No match is a neutral result, shown with the coverage behind it. Severity ranks how directly the evidence matches known indicators, and the strongest evidence sits at the top of your review.
The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. Take a client whose sysdiagnose shows an outdated operating system and a handful of low-rated leads. The report that follows can say what the phone is exposed to, which leads deserve corroboration and which have benign explanations, and what to do next: update the phone, and if a lead stays open, collect a backup or a full file system so the question can be answered with fuller evidence. It can also say, in the same breath, what a sysdiagnose could not tell anyone.
Who it is for, and how it fits
A sysdiagnose examination suits labs and consultancies that deliver device checks to their own customers, and corporate security teams that need a first look at a phone quickly, including one that cannot leave its owner’s hands. It sits where SectraTEK sits: between the security apps you install on your own device and a comprehensive digital forensic examination, a more thorough check for compromise than an on-device scan, without the cost of a full examination.
It also fits the other evidence types. An iOS backup adds the apps and configuration the phone stored. An iOS full-filesystem examination goes deepest. The same detection engines run on the same intelligence in both SectraTEK Full and SectraTEK Lite, and the difference is the workspace around them: Lite keeps the results. Full keeps the case.
No findings means no known indicators were found in the evidence provided. For a sysdiagnose, that sentence comes with a date range and a list of what was and was not checked.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Google Threat Intelligence Group Look What You Made Us Patch: 2025 Zero-Days in Review | cloud.google.com | ||
| [S2] | Citizen Lab First forensic confirmation of Paragon's iOS mercenary spyware finds journalists targeted | Address not listed |
The sources were last read on . If a fact here changes, the correction carries its date.