iOS 26 Update Erases Key Forensic Log, Hindering Spyware Detection on iPhones

Researchers have raised concerns that Apple’s latest software release, iOS 26, quietly removes a crucial forensic tool used to detect infections from sophisticated spyware such as Pegasus and Predator. The change affects a system file known as shutdown.log, a part of Apple’s Sysdiagnose tool that for years has helped security experts trace evidence of digital compromise. 

Investigators at cybersecurity firm iVerify discovered that the log, which previously recorded every instance of an iPhone being powered off and on, is now automatically overwritten each time the device reboots. Earlier versions of iOS appended new entries to the file, preserving a timeline of shutdown events that often contained small traces of malware activity. 

These traces had previously been key in confirming spyware attacks on devices belonging to journalists, activists, and public officials. In 2021, forensic analysts revealed that Pegasus, a surveillance tool developed by the Israeli company NSO Group, left recognizable patterns within the shutdown.log, which became instrumental in public investigations into digital espionage. 

After these findings, Pegasus operators began deleting the file to hide their activity, but even those deletions became a clue for analysts, as an abnormally clean log often pointed to tampering. 

The iOS 26 update now clears this record automatically, effectiv

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.