Skip to content
No description, website, or topics provided.
Roff Python
Branch: master
Clone or download

Latest commit

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
GUI_Version Update mib_parser_GUI.py Jan 1, 2020
images Add files via upload Jan 4, 2019
test data
README.md Update README.md Nov 30, 2019
mib_parser.sql.py

README.md

iOS-Mobile-Installation-Logs-Parser

alt text

Script parses all the logs in the /private/var/installd/Library/Logs/MobileInstalation/.log

Script will produce a currently installed apps report, a uninstalled apps report and historical
reports for both types per app.

The types of rows extracted from the logs are for installed apps,
moved containers, made live containers and destroyed containers.

Usage:

  1. Python 3.6.4 or newer.
  2. Put the script in the same directory as the extracted mobile_installation.log.* files.
  3. Run the script.
  4. Script will produce a SQLite database named mib.db.
  5. Script will produce two directories named Apps_Historical and Apps_State. Apps_Historical contains text files per app with coresponding app entries. App_State contains two text files, one for installed apps and another for uninstalled apps.

In order to run the script again the script generated directories and SQLite db files need to be deleted or moved out of the running directory.

Update on 1/17/2019
Added:

  • Uninstall identifier events
  • Attempting delta patch events with version numbers
  • System reboot events

Update 11/30/2019
Added:

  • GUI version. Requires pip install easygui
You can’t perform that action at this time.