Skip to main content
Introducing logcat.ai 3.0: source-cited findings, team Spaces, robots and moreRead

Solutions / Forensics and audit

This phone stopped blocking unknown apps. Its own logs narrow down when.

Upload the bugreports and packet captures you already hold. logcat.ai reads who managed the device, what it enforced, what it talked to and what changed, and lays it out as one dated timeline. Findings cite the file and line they came from, and where the record stops, it says so.

What it answers
One handset, two bugreports and a packet capture, read on one clockIllustrative. Synthetic data.
  1. 02 Mar 09:14, who manages it
    Fully managed. Administrator enrolled.
    device_policy L41207
  2. 10 Mar 06:02
    Work account added to the device
    account L88402
  3. 14 Mar, from 11:30
    44 flows to 3 hosts, one every 300 s
    capture.pcap frame 1102
  4. Restriction lifted between the two captures
    Unknown apps blocked at A, allowed at B
    L41318 vs L40976
02 Mar
04 Mar
06 Mar
08 Mar
10 Mar
12 Mar
14 Mar
16 Mar
Device policy
bugreport-a + b
Accounts
bugreport-b.zip
Network
capture.pcap
What changed
bugreport-b vs a
02 Mar 09:14, who manages it
Fully managed. Administrator enrolled.
device_policy L41207
10 Mar 06:02
Work account added to the device
account L88402
14 Mar, from 11:30
44 flows to 3 hosts, one every 300 s
capture.pcap frame 1102
Restriction lifted between the two captures
Unknown apps blocked at A, allowed at B
L41318 vs L40976
Each box cites the line it came from.The change falls between the two captures.

What it answers from files you already hold.

A bugreport settles most management and policy questions on its own. Add a packet capture for the network side, and a second capture from another point in time for anything about change.

Who manages this device

Fully managed, work profile or unmanaged, and which management product enrolled it, read from the provisioning state and the enrolled administrators.

bugreport: provisioning state, administrators

What policy is actually enforced

Password rules, screen capture and the user restrictions in force, as the device applied them rather than as the console intended.

bugreport: applied policy

What it talked to

Flows, hosts and connections periodic enough to deserve a second look, with each client and server fingerprinted from its handshake.

packet capture

Which device is which

Hardware addresses resolved to named devices using reference tables in the same upload.

capture + reference tables

What changed between two points in time

Two captures from the same device compared on one clock, with the differences named. Most investigations start here.

two bugreports

Every finding cites its line.

You can check each finding against its line. Each one ends in one of three states.

It reads files you already hold. Acquisition and custody stay with you.

Attested
Carries the file and line it was read from.
Outside the record
Before or after what the files cover. The answer says where each file's record starts and stops.
Unsupported
The files do not settle the question, and the finding says so.

When this comes up

1 bugreport

This device is not what I was told it was

Its management state, enrolled administrators and recorded activity, read out and dated, so what the device says about itself is on the table.

1 bugreport per device

Check what is enforced across a fleet

Policy read from the devices themselves. Put it beside what you meant to enforce and the difference is the finding.

1 bugreport, any captures

Something happened and nobody kept notes

A bugreport and whatever captures exist from around the time, laid on one clock, with where each file's record starts and stops.

Questions investigators ask

What do I need to upload?

A bugreport answers most management and policy questions on its own. Add a packet capture for the network side, and a second capture from another point in time for anything about change.

Where do the files come from?

From you: the bugreports, captures and configuration you already hold. The analysis covers what those files recorded.

Can it tell me if a device is enterprise managed?

Yes, and it distinguishes fully managed from a work profile from unmanaged, and names the management product where the device records it. It reads the provisioning state and the enrolled administrators.

Do you decrypt traffic?

No. Client and server fingerprints are derived from the parts of a handshake that are sent in the clear, along with the server name the client asked for, without touching the encrypted payload.

Is this admissible?

That rests on acquisition and chain of custody, which stay with you. logcat.ai reads the files you already hold, cites what it found, and says where the evidence stops.

Is my log data secure?

Your log data is encrypted in transit (TLS 1.3) and at rest (AES-256), processed in your own tenant, and never used to train AI models. See the architecture page for where data goes and what leaves your environment. Files stay until you delete them, and enterprise contracts set how long deleted files are kept. Enterprise plans offer on-premise deployment for regulated or air-gapped environments.

Bring a bugreport and a question.

A bugreport, and what you are trying to establish. We will read it with you and scope a pilot for your team.