04 · User Activity
knowledgeC.db and Biome: Reconstructing Mac User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
Read guide
Guides tagged: #user-activity
04 · User Activity
Safari Forensics on macOS: History.db, Downloads and Tabs
Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries.
Read guide
04 · User Activity
Spotlight Forensics: Metadata Stores, mdls and Parsing
How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS.
Read guide