Unified Logs are a core component of iOS devices which capture log information on an ongoing basis without any knowledge of the user.

Typically, these logs are used to assist with the diagnosis of issues and errors, and for that reason, the logs are extremely detailed, but short lived.

One interesting artifact I found recently was labeled “Doppler” within the logs. While I have no doubt that the Doppler effect is likely involved somewhere here, I’ll typically refer to it as “Pocket State sensor” from here on.

Proximity Sensor

iPhones have had a proximity sensor for years - you can see this for yourself while in a call by moving the phone close to / away from your face.

But it seems this is now also being used (perhaps differently) for FaceID on devices that have it.

Have you ever noticed that when you pick up an iPhone and point it at your face, it will automatically unlock? That’s the Pocket State / Doppler function in action.

Unified Logs

The Unified Logs have a record for “FrontIR: Doppler” and references to being either in a “pocket state” or “pocket state cleared”.

This is in relation to the InfraRed camera mounted on the front of iPhones (X and above) and used for facial scanning.

The InfraRed camera is mounted on the left side of the “notch” and through some cameras, can be seen flashing when in operation.

It can be noted that the camera is not constantly scanning and will only scan in certain situations.

Testing
The IR Camera was observed through a device capable of showing the IR light as the device was subjected to different stimuli. (Essentially, I used a Google Pixel camera to view the iPhone)

For illustrative purposes, the following images are used to show how the IR camera reacted.

The timing of the tested events was as follows:

The Unified Logs were generated and viewed on a Mac using the default logarchive viewer.

During the time of testing, a total of 1058 records were created which could be grouped based on time.

The groups were as follows:

10:21:00 through to 10:21:10
150 records created each showing the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
These times aligned with the 10 seconds of screen illumination upon the screen being touched.

10:22:01 through to 10:21:11
150 records created each showing the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
These times aligned with the 10 seconds of screen illumination upon the screen being touched.

10:22:30 through to 10:22:40
150 records created each showing the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
These times aligned with the 10 seconds of screen illumination upon the side button being pressed.

10:23:08 through to 10:23:39
406 records created each showing the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
These times aligned with the screen illumination upon the call being received and the time the screen dimmed after the call went unanswered.

10:27:45 through to 10:27:50
89 records created. The first 88 records each show the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
The final record shows the value: “FrontIR: Doppler in pocket state cleared”.
These times aligned with the screen illumination upon the screen being touched and the time the cover was removed.

10:29:08 through to 10:29:15
113 records created. The first 112 records each show the value: “FrontIR: Doppler in pocket state detected” which can be taken to mean “Front camera obstructed”.
The final record shows the value: “FrontIR: Doppler in pocket state cleared”.

These times aligned with the screen illumination upon the screen being touched and the time the cover was removed for the first time. Replacing the cover had no affect.

Raise to Wake
One of the iOS Features that can cause the backlight to illuminate and the Doppler function to fire, is the Raise to Wake feature which detects when the user picks up the device.

This artifact is found in the com.apple.springboard.plist which can be found at private\var\mobile\Library\Preferences.

The specific node is called SBSupportLiftToWake and has a value of either a True or False.

Testing of Raise to Wake, and movement in general, was conducted by rotating, dropping and picking up the device while in a locked state and watching for the activation of the backlight.

The testing process refers to X, Y and Z axis as described in the diagram below.

The results were as follows:

	Z Axis Movement of the device vertically upwards or downwards (Z Axis), including dropping from a height, generally did not cause the backlight to illuminate.
	XY Plane Movement of the device on either the X or Y plane generally did NOT cause the backlight to illuminate.
	Rotation on X Axis Rotation of the device on the X axis (left to right or right to left) generally did NOT cause the backlight to illuminate.
	Rotation on Y Axis Rotation of the device on the Y axis (tilting forwards) DID cause the backlight to illuminate. Rotation of the device on the Y axis (tilting backwards) generally did NOT cause the backlight to illuminate.

As demonstrated in the table above, the only action to reliably cause the Backlight illumination and Doppler function to fire was the rotational movement of the device tilting it forwards to the user on the Y Axis.

Wrapping Up

The FrontIR Doppler function is called whenever iOS believes it is likely that the user is trying to unlock the device. This is triggered by the device screen being touched, side button being pressed, raising to wake, or receiving a call. While notifications from incoming SMS triggered the IR light to flash, no record was written to the logs.

From the testing, this appears to be a reliable artifact when written. i.e. When the record exists, it appears a reliable way to show if the device IR camera was obstructed.