iPhone Forensic Acquisition Issue Raises Concerns About FSEvents Evidence

A reported issue with VeraKey’s full file system acquisition process may cause macOS file-system activity records to disappear during forensic extraction from iPhones, raising questions about evidence preservation and acquisition reliability.

According to Forensic Focus’s October 14, 2026, DFIR roundup, testing across two iPhones and eight previous extractions found that the acquisition process reset the fseventsd-uuid and cleared FSEvents history. Magnet reportedly confirmed that a hotfix was in development.

FSEvents is a macOS mechanism that records file-system changes. Its logs can help investigators identify activity involving files and directories, including when items were created, modified, renamed or removed. Although these records do not independently establish who performed an action, they can contribute to a broader investigative timeline.

If acquisition alters or clears relevant artefacts, investigators could incorrectly interpret missing records as evidence that the activity never occurred. The reported behaviour therefore highlights the need to understand how forensic tools interact with source devices during collection.

Examiners should document the acquisition tool and version, preserve acquisition logs, validate findings against other available artefacts and assess whether the collection process itself could explain missing evidence. The original device and any prior extractions should be preserved where possible.

The report does not establish that every VeraKey acquisition is affected or that evidence has been lost in a specific criminal case. Investigators should consult updated vendor guidance and verify the issue before drawing conclusions.