Skip to content
No description, website, or topics provided.
Roff Python
Branch: master
Clone or download

Latest commit


Type Name Latest commit message Commit time
Failed to load latest commit information.
GUI_Version Update Jan 1, 2020
images Add files via upload Jan 4, 2019
test data Add files via upload Jan 27, 2019 Update Nov 30, 2019 Update Jan 1, 2020


alt text

Script parses all the logs in the /private/var/installd/Library/Logs/MobileInstalation/.log

Script will produce a currently installed apps report, a uninstalled apps report and historical
reports for both types per app.

The types of rows extracted from the logs are for installed apps,
moved containers, made live containers and destroyed containers.


  1. Python 3.6.4 or newer.
  2. Put the script in the same directory as the extracted mobile_installation.log.* files.
  3. Run the script.
  4. Script will produce a SQLite database named mib.db.
  5. Script will produce two directories named Apps_Historical and Apps_State. Apps_Historical contains text files per app with coresponding app entries. App_State contains two text files, one for installed apps and another for uninstalled apps.

In order to run the script again the script generated directories and SQLite db files need to be deleted or moved out of the running directory.

Update on 1/17/2019

  • Uninstall identifier events
  • Attempting delta patch events with version numbers
  • System reboot events

Update 11/30/2019

  • GUI version. Requires pip install easygui
You can’t perform that action at this time.