04 · User Activity
knowledgeC.db and Biome: Reconstructing Mac User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
Read guide
Guides tagged: #sqlite
04 · User Activity
Safari Forensics on macOS: History.db, Downloads and Tabs
Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries.
Read guide
06 · TCC & Keychain
TCC Database Forensics: macOS Privacy Permissions
Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence.
Read guide