crash reports in iOS17 and above

[ICE-FlatLine]

It seems that there are some changes in iOS17 and above on where certain crash reports are being stored on device. For instance, I can see lots of records of crash reports in UI (Settings-->Privacy&Security-->Analytics&Improvments-->Analytics Data), however, when running pymobiledevice3 crash ls command, the output is very limited:
DiagnosticLogs
/Retired
/Panics
/Assistant
/SiriSearchFeedback-2023-11-13-165019.ips
/SiriSearchFeedback-2023-11-14-111816.ips

All the folders are empty.

Can it be that there is an additional location to where certain crash reports are being written on device and CrashReportManager and AfcService in pymobiledevice3 aren't aware of it?

Or is it a permission issue? I wasn't able to find anything related on the subject besides some substantial changes to file system in iOS17:
https://developer.apple.com/forums/thread/733642
Though I am not sure if the article is relevant to the issue of crash reports.

[doronz88]

I have a suspicion for the root cause. Can you verify what bug_type are the missing logs?

[ICE-FlatLine]

Bug type is '309'
You meant the bug_type field in the crash log itself, correct?

[doronz88]

Okay so I'm pretty certain of it.

On iOS 17, Apple added another crash report directory at:

/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.osanalytics/DiagnosticsReports

This data is referred in device logs and code as "DataVault". It seems this acts as a second storage for the more "important" crash reports, where its harder to delete from. Don't know what is the real purpose of it, but it seems we can still peek these contents using backup.

From my understanding, its only for bug_type 309.

[ICE-FlatLine]

Thanks for the swift response.
Any chance to be able to read/copy/delete from it? Or does that require jailbreak?

[doronz88]

From my understanding, you can read/copy using the device backup but never delete - unless you have a jailbreak

[ICE-FlatLine]

Ok, thanks!
I'll try collecting it using backups