Skip to content
No description, website, or topics provided.
Roff Python
Branch: master
Clone or download
Latest commit 0f75ace Nov 30, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
GUI_Version Add files via upload Nov 30, 2019
images Add files via upload Jan 4, 2019
test data Add files via upload Jan 27, 2019
README.md
mib_parser.sql.py Updated to support utf8 encoding Feb 21, 2019

README.md

iOS-Mobile-Installation-Logs-Parser

alt text

Script parses all the logs in the /private/var/installd/Library/Logs/MobileInstalation/.log

Script will produce a currently installed apps report, a uninstalled apps report and historical
reports for both types per app.

The types of rows extracted from the logs are for installed apps,
moved containers, made live containers and destroyed containers.

Usage:

  1. Python 3.6.4 or newer.
  2. Put the script in the same directory as the extracted mobile_installation.log.* files.
  3. Run the script.
  4. Script will produce a SQLite database named mib.db.
  5. Script will produce two directories named Apps_Historical and Apps_State. Apps_Historical contains text files per app with coresponding app entries. App_State contains two text files, one for installed apps and another for uninstalled apps.

In order to run the script again the script generated directories and SQLite db files need to be deleted or moved out of the running directory.

Update on 1/17/2019
Added:

  • Uninstall identifier events
  • Attempting delta patch events with version numbers
  • System reboot events

Update 11/30/2019
Added:

  • GUI version. Requires pip install easygui
You can’t perform that action at this time.