iOS 26 Overwrites ‘shutdown.log’ on Reboot, Erasing Forensic Evidence of Pegasus and Predator Spyware

iOS 26 now overwrites the shutdown.log file on every reboot, erasing forensic evidence of Pegasus and Predator spyware infections, a change described as a key forensic challenge for investigators. The article notes that shutdown.log, stored within the Sysdiagnoses in the Unified Logs section, has historically documented activity during device shutdown sequences and aided detection of iOS malware.

It traces Pegasus’ evolution to 2021, when traces were first left in shutdown.log, and to 2022, when the NSO Group began wiping the file to avoid detection, though this still produced forensic signatures. Predator, first observed in 2023, is said to have shown similar behaviour, with security researchers assessing that it likely left comparable traces.

According to the article, Apple’s iOS 26 overwrites rather than appends to shutdown.log on reboot, a change that sanitises the artifact used to identify compromises, potentially hindering retrospective investigations for devices updated to iOS 26. The piece also notes that for devices on iOS 18 or earlier, investigators can correlate containermanagerd logs with shutdown.log entries to identify potential compromises.