Skip to main content
The Dark Art of Postmortem DebuggingRead
Illustrative. Synthetic data.
Form 1 of 7 : record of custody, as written by the device

The device wrote down who managed it, what was enforced, and since when.

logcat.ai reads it back as a ledger: each entry dated, attributed to the subsystem that recorded it, cited to its line. Where the record stops, the ledger says so.

What it answers
Fig. 1 : what the record coversCAPTURE ACAPTURE BGAP 7H 21M, NOT RECORDED02 MAR 09:1416 MAR 08:00
412,880lines in the bugreport
8entries in the record
7 of 8cited to a source line
7h 21mnot recorded, one gap
No. RecordedStatus
012025-03-02 09:14:07attested
Provisioning state set: fully managed, device owner presentDevice policy : bugreport-a : L41207
022025-03-02 09:14:09attested
Administrator enrolled: com.example.fleetctl / .DeviceAdminDevice policy : bugreport-a : L41233
032025-03-02 09:15:40attested
Password policy applied: quality complex, minimum length 8Device policy : bugreport-a : L41290
042025-03-02 09:15:41attested
User restriction in force: no_screen_captureDevice policy : bugreport-a : L41318
05 03-09 22:41 to 03-10 06:02NOT RECORDED
No entry survives for 7h 21m: the log buffer wrapped across a rebootNobody : no line to cite
062025-03-10 06:02:15attested
Work account added to the managed profileAccounts : bugreport-a : L88402
072025-03-14 11:30:02attested
44 flows to 3 hosts, one every 300 s; client fingerprint matched from the clear part of the handshake, nothing decryptedPacket capture : capture.pcap : frame 1102
082025-03-16 08:00:00attested
Restriction no longer in force since capture A: no_install_unknown_sourcesDelta, A vs B : A L41318 vs B L40976
7 attested. 1 gap, reported as not recorded.Sheet 1 of 7
Note : not a chain-of-custody claim

This is the device's account of itself, read from files you already hold. Acquisition, custody and admissibility stay yours.

Forensics and enterprise audit
Form 1 of 7 : record of custody, as written by the deviceIllustrative. Synthetic data.
Case [your case no.]Item 01 : one handsetSources : 2 bugreports, 1 packet capture

The device wrote down who managed it, what was enforced, and since when.

logcat.ai reads it back as a ledger: each entry dated, attributed to the subsystem that recorded it, cited to the line it came from. Where the record stops, the ledger says so instead of filling it in.

The idea: a bugreport is the device's own account of who administered it and what was enforced, entry by entry, so laid out as a custody ledger the gaps become visible.

What it answers
Fig. 1 : what the record coversCAPTURE ACAPTURE BGAP 7H 21M, NOT RECORDED02 MAR 09:1416 MAR 08:00
Note : not a chain-of-custody claim

This is the device's account of itself, read from files you already hold. Acquisition, custody and admissibility stay yours.

412,880lines in the bugreport
8entries in the record
7 of 8cited to a source line
7h 21mnot recorded, one gap
No.RecordedEntryRecorded bySourceStatus
012025-03-02 09:14:07Provisioning state set: fully managed, device owner presentDevice policybugreport-a.zipdevice_policy : L41207attested
022025-03-02 09:14:09Administrator enrolled: com.example.fleetctl / .DeviceAdminDevice policybugreport-a.zipdevice_policy : L41233attested
032025-03-02 09:15:40Password policy applied: quality complex, minimum length 8Device policybugreport-a.zipdevice_policy : L41290attested
042025-03-02 09:15:41User restriction in force: no_screen_captureDevice policybugreport-a.zipdevice_policy : L41318attested
0503-09 22:41 to 03-10 06:02No entry survives for 7h 21m: the log buffer wrapped across a rebootNobodyno line to citeNOT RECORDED
062025-03-10 06:02:15Work account added to the managed profileAccountsbugreport-a.zipaccount : L88402attested
072025-03-14 11:30:0244 flows to 3 hosts, one every 300 s; client fingerprint matched from the clear part of the handshake, nothing decryptedPacket capturecapture.pcapframe 1102attested
082025-03-16 08:00:00Restriction no longer in force since capture A: no_install_unknown_sourcesDelta, A vs Bbugreport-a vs bugreport-bL41318 vs L40976attested
Entries 01 to 08 read from one bugreport, one packet capture and one later bugreport on a shared clock. 7 attested to a source line. 1 gap, reported as not recorded rather than inferred.Sheet 1 of 7
Form 2 of 7 : why the record is hard to readlogcat.ai : forensics and enterprise audit
Why it is hard

The evidence is present and unreadable.

Not missing. Buried in the one file format nobody opens for pleasure.

412,880lines in one bugreport. 5 of them settle who manages the device.
Fig. 2 : the file, drawn to scale, with the lines that answer the question markedIllustrative. Synthetic data.
L1L412880L41207 to L41318 : device policy, 4 entriesL88402 : accounts, 1 entryeverything else : a quarter of a million lines that are not about any of it
2.1A bugreport is hundreds of thousands of lines

Management state, policy, installed administrators and account activity are all in there, in different sections, in different shapes, next to a quarter of a million lines that are not about any of it.

2.2The answer is in a vocabulary you have to already know

Whether a device is enterprise-managed is a provisioning state and an administrator component name, not a sentence. Knowing which field settles it is the expertise the question is blocked on.

2.3"What changed?" needs two captures and a clock

One snapshot tells you the current state. The question is almost always what it used to be, which means reading two captures against each other on a timeline that agrees.

Form 3 of 7 : what it answerslogcat.ai : forensics and enterprise audit
What it answers

Questions with an answer in the file.

Each of these is read out of what the device recorded, and cited back to the line it came from.

Fig. 3 : the two states of a finding
attestedcarries the line it was drawn from
UNSUPPORTEDthe files do not support it, so it is said
No.QuestionWhat is read outRead fromSource
3.1Who manages this device

Whether it is fully managed, carries a work profile, or is unmanaged, and which management product is responsible. Read from the provisioning state and the enrolled administrators rather than inferred from installed packages.

provisioning state, enrolled administratorsbugreport
3.2What policy is actually enforced

Password rules, screen capture restrictions, update policy and the user restrictions in force, as the device has them applied, not as an administrator intended them.

applied policy, user restrictions in forcebugreport
3.3What the traffic shows

From a packet capture: who talked to whom, client and server fingerprints derived from encrypted handshakes without decrypting anything, flows periodic enough to be worth a second look, and files reconstructed out of the stream.

flows, the clear part of each handshake, periodicitypacket capture
3.4Which device is which

Hardware addresses and opaque identifiers resolved to named devices, using the reference tables in the same upload. Anything that cannot be identified is reported as unidentified rather than guessed.

reference tables in the same uploadcapture + tables
3.5What changed between two points in time

Two captures from the same machine compared on one shared clock, with the differences named. This is the question a single snapshot cannot answer and the one most investigations actually start from.

two captures, one shared clockDelta, A vs B
3.6With the line it came from

Every finding carries the evidence it was drawn from, so a conclusion can be checked rather than trusted. An answer the files do not support is reported as unsupported.

every finding aboveany of the above
Six questions, each answered from a file you already hold and each carrying its line. Where the files run out, the answer is marked unsupported rather than produced.Sheet 3 of 7
Form 4 of 7 : how this reaches youlogcat.ai : forensics and enterprise audit
Use cases

How this reaches you.

Three questions that arrive as an investigation, and what the files settle.

Figures illustrative. Synthetic data.
Case 4.1Files : 1 bugreport
This device is not what I was told it was

A handset whose history does not match its story. The management state, the enrolled administrators and the recorded activity are read out and dated, so what the device says about itself is on the table.

PROVISIONED, ADMIN ENROLLEDACCOUNT ADDED, 10 MARWHAT THE DEVICE SAYS ABOUT ITSELF, DATED02 MAR16 MAR
Case 4.2Files : 1 bugreport per device
Prove what is enforced across a fleet

Policy read from the devices themselves rather than from the console that was supposed to apply it. The gap between intended and applied is the finding.

INTENDED (OUTLINE) VS APPLIED (SOLID)D01D02D03GAPD04D05GAPD062 OF 6 : APPLIED FALLS SHORT OF INTENDED
Case 4.3Files : 1 bugreport, any captures
Something happened and nobody kept notes

A bugreport and whatever captures exist from around the time. The investigation reads them together and reports what the evidence supports, including where it runs out.

WHAT EXISTS FROM AROUND THE TIMEPACKET CAPTURE, 40 MINBUGREPORT, TAKEN AFTERNO RECORDTHE EVIDENCE RUNS OUT HERE
In every case the finding is what the device recorded, dated and cited, set against what somebody said. Where the record stops, that is reported too.Sheet 4 of 7
Form 5 of 7 : what this is not, and what it draws onlogcat.ai : forensics and enterprise audit
Boundary

What this is not.

This reads logs, captures and configuration that already exist. It is not a forensic imaging tool, it does not acquire evidence, it makes no chain-of-custody claim, and it cannot recover what the device never recorded. Where the files do not support a conclusion it says so instead of producing one.

Note : read against sheet 1

Every attested entry there names a file you uploaded. Nothing on the sheet came from anywhere else, and the one gap was left as a gap.

No.ClaimWhat is true insteadStatus
5.1Forensic imaging

It reads logs, captures and configuration that already exist. It does not image a device.

not this
5.2Evidence acquisition

Nothing is pulled from a device by the platform. You bring the files.

not this
5.3Chain of custody

No claim is made. The ledger is the device's account of itself; custody stays yours.

no claim made
5.4Recovering what was never recorded

A gap in the record stays a gap. It is reported as not recorded, never filled in.

cannot
5.5A conclusion the files do not support

Where the evidence runs out, the answer is marked unsupported instead of produced.

refused
Sheet 5 of 7
Form 6 of 7 : questionslogcat.ai : forensics and enterprise audit
FAQ

Frequently asked questions.

Five questions, answered in full
No.QuestionAnswerIn short
6.1What do I need to upload?

A bugreport answers most management and policy questions on its own. Add a packet capture for the network side, and a second capture from another point in time for anything about change.

1 bugreport, optional pcap, optional second capture
6.2Can it tell me if a device is enterprise managed?

Yes, and it distinguishes fully managed from a work profile from unmanaged, and names the management product where the device records it. It reads the provisioning state and the enrolled administrators rather than guessing from installed applications.

provisioning state, enrolled administrators
6.3Do you decrypt traffic?

No. Client and server fingerprints are derived from the parts of a handshake that are sent in the clear, which identifies the software making the connection without touching the encrypted payload.

the clear part of the handshake only
6.4Is this admissible?

We make no such claim. This is an analysis tool over files you already hold: it reads them, cites what it found, and says where the evidence stops. Chain of custody, acquisition and admissibility are yours.

no claim made
6.5Is my log data secure?

Your log data is encrypted in transit (TLS 1.3) and at rest (AES-256), processed in your own tenant, and never used to train AI models. See the architecture page for where data goes and what leaves your environment. Files are deleted after 90 days, or immediately from your dashboard. Enterprise plans offer on-premise deployment for regulated or air-gapped environments.

your tenant, encrypted, 90 days
Sheet 6 of 7
Form 7 of 7 : bring us a device and a questionlogcat.ai : forensics and enterprise audit
Next step

Bring us a device and a question.

A bugreport, and what you are trying to establish. From there we will scope a pilot for your team.

Form 7 : your first entry, left blank on purposeNothing here is filled in until you send a file
No.RecordedEntryRecorded bySourceStatus
01[your date][what you are trying to establish][the device][a bugreport]pending
02[your date][what changed, if a second capture exists]Delta, A vs B[a second capture]pending
logcat.ai reads the record, dates it, cites it, and says where it stops.Sheet 7 of 7