Logs are one of the more painful parts of most cases — not because they're rare, but because they come from different sources, in different formats, and sometimes only as raw binary to begin with.
That's the gap Peach is built for — a new tool, and the newest addition to the crush ecosystem, for working with log data. It started because of one specific, painful version of that problem: Apple Unified Logs. Processing AUL at all is already a hurdle — it doesn't run on every system out of the box, something crush has since improved on — and once it does run, it's heavy: the underlying tooling can take a while to churn through a full extraction. What I wanted was something that processes the whole batch quickly, lets you pick a session back up later instead of starting over, and lets you set tags and notes as you go — for reuse later, not just for the one pass you're on.
But somewhere along the way, Peach stopped being an AUL tool. It's grown into something broader: a session-based analysis workbench for log data in general — AUL, EVTX, journald, and text-based logs, all handled the same way, all in the same place.
Sessions as the common thread
Peach has session handling.
A case rarely comes with just one log type. In Peach, a single session can hold AUL, EVTX, journald, and text-based logs together — the iPhone's Unified Log, the Windows event log from the same incident, the Linux server's journal, all in one place, cross-referenced with your own notes and tags.
You can close it, come back the next day, and everything — tags, notes, loaded sources — is still there.
What about crush's own log viewer?
crush has had a multi-log viewer for a while, and it's genuinely good for what it's for: opening a file and quickly seeing what's in it. It can technically handle AUL too — I just wouldn't recommend it for that, it's noticeably more time-intensive than going through Peach. Think of it as the quick look, with Peach as the place you go when the analysis needs to actually go somewhere and stay somewhere.
The formats
AUL is where it started, and still gets the most dedicated rule set — more on that below.
EVTX and journald come with their own rule sets, more IR-focused than the AUL rules — built around what tends to matter when you're looking at an incident rather than reconstructing a timeline of normal use.
Text-based logs work differently: there's no fixed rule set, because the formats vary too much. Instead, you set patterns live against the file to extract fields as you go. For some formats — syslog and pacman.log, for instance — this is already built out and ready to use. Tagging for text-based logs isn't there yet; that's still on the list.
Rules that keep growing
The tagging rules — and, for text-based logs, the format patterns — aren't a fixed set from day one. They're maintained and extended on an ongoing basis, as new artifacts get documented or new patterns turn out to be worth tagging. They all live in the open in the Peach repo, TOML files, if you want to see what's covered right now or track what gets added over time. A simple one looks like this:
[rule] name = "aul_motion_state" description = "Motion/activity state transitions (walking, stationary, etc.)" [rule.match] sourcetype = "aul" message_contains = "Motion State Transition:" [rule.tag] value = "motion_state"
From crush to Peach: an AUL example
Since AUL is where Peach began, it's also the clearest example of the workflow end to end. The starting point is usually inside crush, with an iOS full filesystem extraction open.
Right-click the AUL folder (/private/var/db/diagnostics), and there's a "Send to Peach" option in the context menu.
Peach loads the data and shows the result with tags already applied from the rule set.
From there it's a normal analysis surface: I can add my own notes to specific entries,
and set my own tags on the fly — without needing to write a formal rule first. Sometimes I just want to mark something as interesting before I know yet whether it deserves to become a reusable rule. Also I can filter on time near one event.
One more thing Peach is useful for: building new rules. Spotting a pattern in the raw log and turning it into a reusable rule is a lot faster when you can search and filter the source material directly and see all events in one view.
A quick word on iLEAPP
With iLEAPP v2.2.0, AUL support landed with awesome results and awesome processing speed. I already worked on the AUL support in Peach the moment iLEAPP added support. I pulled a handful of rules from their AUL module into Peach myself; full credit is documented in each rule in the repo, no secrets there. A good chunk of the underlying artifact research behind those rules — and behind my own — comes from Tim Korver's Thesis Friday series, which has been steadily working through AUL artifacts one at a time - a really nice blog series in AUL.
Why "Peach"?
As a few people already know, I'm a big fan of Finding Nemo. Peach is named after the starfish stuck to the fish tank glass — the one who somehow always has the full overview of everything going on around her. That's pretty much the job description here too.
And yes, Rainbow Mode is back
Rainbow Mode is back — still courtesy of @dugeonlady, who suggested it in the first place because digital forensics tools don't have to be grey. Or dark. She was right then, and she's right now.
Getting it
Peach 0.2.1 is available as a standalone executable for all platforms — no installer, no dependencies to sort out first. Peach releases
crush 0.16.0, with the Peach integration built in, comes in several flavors depending on your platform — check the README for the full list, or grab the latest release directly. crush releases
🐢⭐
