In my testing you will see artifacts from two iOS devices:<\/p>\n
- \n
- \n
Sender: Elwood\u2019s iPhone<\/p>\n<\/li>\n
- \n
Receiver: miPhone11 <\/p>\n<\/li>\n<\/ul>\n
Note: This article focuses on iOS. For macOS you will likely have to add –info to these queries to acquire similar information.<\/p>\n
Starting with the AirDrop basics \u2013 we need to determine the AirDrop ID for each user. One thing I\u2019ve discovered since my last analysis was that the AirDrop ID is not consistent for the life of the device, it changes all the time! The last (current) AirDrop ID can be found in the \/private\/var\/mobile\/Library\/Preferences\/com.apple.sharingd.plist on iOS devices. I\u2019ve even seen where there is no AirDrop ID in this plist due to AirDrop inactivity. The following query can provide the Airdrop IDs that are still available in the unified logs.<\/p>\n
log show system_logs.logarchive --predicate 'eventMessage contains \"AirDrop ID\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363587806-1MYHZXEI7A17DZSHNFL5\/img1.png?format=1000w\")
<\/p>\n<\/figure>\nWe may also want to know what Discoverability Mode was being used at the time. A quick query for this is to look for \u2018SharingDaemon\u2019 which contains some sharingd metadata information.<\/p>\n
log show system_logs.logarchive --predicate 'eventMessage contains \"SharingDaemon State\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363639661-FV3AEWGHA8194XGDQDEQ\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nThese messages contain a few useful items:<\/p>\n
- \n
- \n
Device make\/model<\/p>\n<\/li>\n
- \n
iOS Version<\/p>\n<\/li>\n
- \n
Battery Status<\/p>\n<\/li>\n
- \n
Discoverability mode (Everyone, Contacts Only, Off)<\/p>\n<\/li>\n
- \n
Screen Status<\/p>\n<\/li>\n
- \n
Unlock Status<\/p>\n<\/li>\n
- \n
Wireless Proximity Status<\/p>\n<\/li>\n<\/ul>\n
In our contrived scenario we are assuming the receiver has their discoverability mode set to \u2018Everyone\u2019 during the time in question. The current mode can also be seen in the com.apple.sharingd.plist file. One more way of seeing the discoverability mode is by using this query (yes, I accidentally put in two –info arguments, this of course is not required):<\/p>\n
log show --info system_logs.logarchive --predicate 'eventMessage contains \"Scanning mode\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363688564-XWUT23ZIH0Y5NY98VRYV\/img3.png?format=1000w\")
<\/p>\n<\/figure>\nOn the Sender Device (Elwood\u2019s iPhone):<\/strong><\/h3>\n
Sharing Methods<\/strong> <\/p>\n
The first indication of AirDrop usage is how it is being initiated. This process is known as the \u2018ShareSheet\u2019. This is the window that is presented to the user to choose how they want to share an item. In this screenshot, I want to share a photo from within the Photos app. We can choose AirDrop, Messages, Mail, Notes, etc. Below that is a set of other activities that can be performed on the chosen photo.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363740024-B6MWYJTXJMEGGOTHMYCI\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nThis query can show us what application an item is being shared from. Each shared item may have different sharing options. This blog will show activity while AirDropping a photo, a note, a map, and a Safari link. <\/p>\n
log show system_logs.logarchive --predicate 'category = \"ShareSheet\" or category = \"SharingUI\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363787093-WN33WBHUI45UZFOEXORX\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nStarting at the top, a good indicator that something is about to be shared is to look for the message \u2018Activating com.apple.sharing.sharesheet\u2019. A connection will be made with the specific app that is to be shared from, in this example com.apple.mobileslideshow (Photos).<\/p>\n
The items highlighted in red are looking for people to share with. This particular device is a test device with no contacts; therefore none were suggested. <\/p>\n
The items highlighted in purple and blue show the Share and Action activities that the user should see in the ShareSheet view.<\/p>\n
In green, the \u201cperforming activity\u201d message shows that AirDrop was selected by the user.<\/p>\n
In pink, messages that start with \u201cItem:\u201d and have a GUID show that photos need a bit more preparation (file conversion, thumbnail creation, etc.). This was not seen in shared notes, maps, and Safari links. This specific activity can be filtered by using the GUID as shown below. The items highlighted in dark green provide temporary file paths used for the preparation but most importantly a filename that should be consistent with the item filename in the Photos.sqlite database (IMG_6782.JPG).<\/p>\n
log show system_logs.logarchive --predicate 'eventMessage contains \"74745469-9184-442C-B49D-5BE37CDD8CAA\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363924175-0MW7Q6OK7J93GRY07KAE\/img6.png?format=1000w\")
<\/p>\n<\/figure>\nMore examples sharing methods of an AirDropped Note, Map, and a Safari Link are shown below. Notice the differences in the activities for each application. <\/p>\n
Note<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591363984040-OG1KVZELLDVK05M2PDIM\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nMap<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364004285-APWR1LC3T6QPBKK0LF42\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nSafari Link<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364034697-PZWT3EIJDVUMCGKIN58U\/img9.png?format=1000w\")
<\/p>\n<\/figure>\nAirDropping an Item<\/strong><\/h3>\n
Just because we see something was attempted to be shared, does not necessarily mean it was actually sent and received. The first part of this process is finding someone to AirDrop something to. I will be using the following query to go through some of these entries. <\/p>\n
log show system_logs.logarchive --predicate 'category = \"AirDrop\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364092389-I53JP1S9V545SK7C1X50\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nIn the screenshot above I\u2019ve changed the default style to compact [with –style]<\/a> to fit more in the screenshot. This shows the iPhone attempting to discover known and unknown contacts via Bonjour and AWDL<\/a>. Highlighted are the entries that find my MacBook Air (Airdrop ID: eb4f5a53391b). Note the AWDL IPv6 addresses shown in yellow. These do appear get cached on the receiving end (look for messages that contain \u201ccom.apple.p2p: Caching peer:\u201d). It appears AWDL IPv6\/MAC addresses get rotated fairly frequently. These is another way of pairing two each device together (along with AirDrop IDs) but these are not kept forever and you need both devices to do this analysis.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364636158-YX50RXM63S5AXYH7652M\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nNow that we have AirDrop contacts, lets send a photo! I sent a photo from Elwood\u2019s iPhone to miPhone11 (IMG_6782.JPG) via Photos.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364671232-RAQ1ST31Q7208X4J43O4\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nThe message that start with \u201cstartSending\u201d (in yellow) is what is being AirDrop\u2019ed. It shows the item or file that it is sending along with the Receiver ID and Session ID. The Receiver ID is the AirDrop ID for the device that this item is being sent to, while the Session ID keeps track of this AirDrop session.<\/p>\n
In green, the AirDrop transaction is started, however in dark green it shows that a connection cannot be made. During my testing, my miPhone11\u2019s AirDrop ID got caught in an odd cached state with the wrong ID (3603f73a17de). The first time I attempted to AirDrop this photo it failed. It eventually discovered the correct ID (ecec57b722d8). Elwood\u2019s iPhone showed a \u2018Waiting\u2026\u2019 message and the transaction would not complete.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364700160-H6A2QVLLCK6ZCZ5AQQG4\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nThe second time around it actually sent. Note the changed AirDrop ID for miPhone11 is now 04f30cbdcb55. These IDs change all the time. It also recognizes the device can handle a live photo in an HEIC file format, so it sends that instead of the JPG.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364730958-2N149KJHL37FCHO2Z4UE\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364745084-0S7B97LHRL546QWHN26V\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nThe ShareSheet information for the Live Photo is below. I recommend matching up the GUIDs to find this information. Filtering for 6C85AC86-BEF2-42BC-9862-4982211791DF (from the screenshot above) would allow me to run the query below to find the rest of the actions associated with this asset.<\/p>\n
log show system_logs.logarchive --predicate 'eventMessage contains \"A79A3C4F-AF63-486E-A7FC-4173753B12E2\"'<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364788928-9GISLOVICLVGXEY1MZFU\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nA few more AirDrop examples, a note, a map, and a Safari link.<\/p>\n
Note<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364829683-BMEB1I2I1R8L8EJCW283\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364850105-BQL0FV7XDH485HEPGYSP\/img17.png?format=1000w\")
<\/p>\n<\/figure>\nThese entries show a note with the title \u2018This is a threatening note!\u2019 was shared but no contents of the note itself.<\/p>\n
Map<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364987000-0NEGQGBM2DD5TJ0EOT3E\/img22.PNG?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591364898616-6LB3F7E09UPO5PTOU02I\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\nSharing a Map item, provides title but no exact address in this example.<\/p>\n
Safari Link<\/strong><\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365027096-HE9NCVVTE0I1TKQW06F0\/img23.PNG?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365054414-KQCNB6S69LBRBAJPQAG7\/img19.png?format=1000w\")
<\/p>\n<\/figure>\nSending a Safari link shows the domain but no specific details on the URL. <\/p>\n
The same Safari link as a PDF file:<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365094363-8QL7TI5RFNDZETCM9LWM\/img24.PNG?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365117580-LZF9Y8NMQOH0ZLI0ZOWB\/img20.png?format=1000w\")
<\/p>\n<\/figure>\nSending the same link but as a PDF shows no domain at all.<\/p>\n
These items lose context when only the unified logs are looked at. You may have to correlate these actions with other application databases and artifacts (Photos, Notes, Maps, Safari History, etc.) to provide this context.<\/p>\n
On the Receiving Device (miPhone11):<\/strong><\/h3>\n
We will be using a generic AirDrop query to find all entries associated.<\/p>\n
log show system_logs.logarchive --info --predicate 'category = \"AirDrop\"'<\/code><\/pre>\nA user receiving files can choose to accept or decline. These responses are documented in the unified logs.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365211997-C4D3LTNA7MTWG2Z5BOWN\/image-asset.png?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365242685-9LXC43WK144DX9EOEF2P\/img27.png?format=1000w\")
<\/p>\n<\/figure>\nFor an incoming transfer an AirDrop connection is made with an identifier (0x101495960). After this entry there are quite a few lines detailing what type of file it is and where it is coming from. To know if the user has Accepted or Declined the transfer we need to focus on the \u2018userResponse\u2019 sections. The entry shown in green is the popup alert that is presented to the user to do this action.<\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365283820-7MDRMO8WBF2IOBAL3PIH\/img28.png?format=1000w\")
<\/p>\n<\/figure>\nOnce the user has selected \u2018Accept\u2019, the transfer continues and is opened up in the default application for the file. This example shows the photo being imported and opened in Photos (com.apple.mobileslideshow). Once complete, the AirDrop connection is terminated. This photo could be found by looking for the \u201c16C753E1-309A-46FD-A742-998D7A31047E\u201d ZUUID in the ZGENERICASSET table of the Photos.sqlite database and looking for the associated file name.<\/p>\n
If the user declines the AirDrop transfer the same message would show Declined or Cancelled and the AirDrop connection is terminated. <\/p>\n
<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365326131-QO02GCPZM7942FS6BSTU\/img29.png?format=1000w\")
<\/p>\n<\/figure>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365351097-TF5GS129YQVW9IW9HWP5\/img26.PNG?format=1000w\")
<\/p>\n<\/figure>\nHow about an all-in-one query to tell me what transfers were initiated, from whom, where they Accepted or Declined, and opening information.<\/p>\n
log show system_logs.logarchive --predicate 'category = \"AirDrop\" and (eventMessage contains \"New incoming transfer\" or eventMessage contains \"Opening URLs:\" or eventMessage contains \"alertLog: idx:\")' --style compact<\/code><\/pre>\n<\/p>\n ![\"\"](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1591365396816-7RBV6U1CP1QQ4H0BWG3M\/img30.png?format=1000w\")
<\/p>\n<\/figure>\nEach of the gray highlighted sections is an incoming transfer from Elwood\u2019s iPhone. Some transfers have an \u2018Opening URLs\u2019 entry that provides more context to what was sent, especially when it comes to Map and Safari links. It should be pointed out that just because you see a hostname like Elwood\u2019s iPhone to be careful with attributing it to Elwood. Device hostnames are incredibly easy to change to let\u2019s say\u2026\u2019Jake\u2019s Google Pixel! <\/p>\n
I spent ages trying to come up with a smoking gun on a \u2018victim\u2019 device to attribute an AirDrop action to a specific sender device. There really does not appear to be a static identifier to be able to identify a specific address. AirDrop ID, AWDL IPv6\/MAC addresses are the only way to pair these actions between devices but you need both devices to be able to do this type of correlation. This, of course, can be tricky in most investigations. Even if you do have access to the devices, the data gets flushed fairly quickly \u2013 you may only have a few days to acquire these logs.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
I\u2019ve written about this before in this article but wanted to revisit it for this series. For this scenario I want to test what certain items might look like when they are AirDrop\u2019ed from an unknown source. Many schools have been receiving bomb threats via AirDrop, I want to see if there is a way […]<\/p>\n","protected":false},"author":1,"featured_media":96571,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11768],"tags":[45654,10990,1332,1837,19817,6321,26948,38903,26747],"dealstore":[],"offerexpiration":[],"class_list":["post-96570","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apple-2","tag-airdropping","tag-analysis","tag-apple","tag-edition","tag-entry","tag-knowledge","tag-logs","tag-quarantine","tag-unified"],"yoast_head":"\n
Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=96570\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"I\u2019ve written about this before in this article but wanted to revisit it for this series. For this scenario I want to test what certain items might look like when they are AirDrop\u2019ed from an unknown source. Many schools have been receiving bomb threats via AirDrop, I want to see if there is a way […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=96570\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-19T02:19:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG\" \/>\n\t<meta property=\"og:image:width\" content=\"1125\" \/>\n\t<meta property=\"og:image:height\" content=\"445\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=96570#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge\",\"datePublished\":\"2025-02-19T02:19:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570\"},\"wordCount\":1647,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG\",\"keywords\":[\"AirDropping\",\"Analysis\",\"Apple\",\"Edition\",\"entry\",\"Knowledge\",\"Logs\",\"Quarantine\",\"Unified\"],\"articleSection\":[\"Apple\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=96570#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=96570\",\"url\":\"https:\/\/fivemor.com\/?p=96570\",\"name\":\"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG\",\"datePublished\":\"2025-02-19T02:19:47+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=96570#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=96570\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=96570#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG\",\"width\":1125,\"height\":445},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=96570#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=96570","og_locale":"en_US","og_type":"article","og_title":"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network","og_description":"I\u2019ve written about this before in this article but wanted to revisit it for this series. For this scenario I want to test what certain items might look like when they are AirDrop\u2019ed from an unknown source. Many schools have been receiving bomb threats via AirDrop, I want to see if there is a way […]","og_url":"https:\/\/fivemor.com\/?p=96570","og_site_name":"Som2ny Network","article_published_time":"2025-02-19T02:19:47+00:00","og_image":[{"width":1125,"height":445,"url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=96570#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=96570"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge","datePublished":"2025-02-19T02:19:47+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=96570"},"wordCount":1647,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=96570#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG","keywords":["AirDropping","Analysis","Apple","Edition","entry","Knowledge","Logs","Quarantine","Unified"],"articleSection":["Apple"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=96570#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=96570","url":"https:\/\/fivemor.com\/?p=96570","name":"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=96570#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=96570#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG","datePublished":"2025-02-19T02:19:47+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=96570#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=96570"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=96570#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/02\/img25.PNG","width":1125,"height":445},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=96570#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] \u2013 AirDropping Some Knowledge"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/96570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=96570"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/96570\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/96571"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=96570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=96570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=96570"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=96570"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=96570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- \n