04 · User Activity
knowledgeC.db and Biome: Reconstructing Mac User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
Read guide
04 · Evidence area
User Activity
Pattern-of-life data answers the questions interviews cannot: which app was in focus, which file came from which URL, what was searched and browsed. This area covers knowledgeC.db, the newer Biome SEGB streams, Spotlight metadata and Safari history.
- knowledgeC.db
- Biome
- History.db
- .Spotlight-V100
3 guides in this area
04 · User Activity
Spotlight Forensics: Metadata Stores, mdls and Parsing
How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS.
Read guide04 · User Activity
Safari Forensics on macOS: History.db, Downloads and Tabs
Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries.
Read guide
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- knowledgeC.db: macOS App Usage and Device ActivityCoreDuet SQLite database recording app usage, focus, display and power state on macOS, used to show when and how long apps were in use.
- Biome SEGB Streams: macOS App Focus and ActivityBiome stores macOS activity streams such as App.InFocus in SEGB files of protobuf records, the successor to many knowledgeC.db streams.
- Screen Time Databases: macOS App Usage TotalsScreenTimeAgent RMAdminStore databases on macOS hold per-app and per-domain usage totals, pickups and notification counts per device and user.
- Safari History.db: macOS Browsing HistorySafari History.db, profile databases, Downloads.plist and tab stores on macOS: which pages a user visited, when, and what was deleted.
- Chrome and Firefox History on macOSChrome History and Firefox places.sqlite on macOS: paths, profiles, key tables and epochs to rebuild visits and downloads outside Safari.
- Recent Items (.sfl2/.sfl3): macOS Shared File Listssharedfilelistd lists of recent documents, apps, servers and per-app Open Recent entries, stored as NSKeyedArchiver plists with bookmarks.
- Dock and Finder Plists: macOS User Preference Evidencecom.apple.dock.plist and com.apple.finder.plist record pinned and recent apps, recent folders, Go to Folder history, servers and searches.
- Notification Center Database: macOS Notification HistoryThe usernoted SQLite database keeps delivered macOS notifications with app, title, body and time, often preserving message text from other apps.
- Messages chat.db: macOS iMessage and SMS Historychat.db is the macOS Messages SQLite database of iMessage, SMS and RCS conversations, participants, attachments and recently deleted messages.
- Apple Mail: Envelope Index and EMLX on macOSApple Mail keeps message metadata in the Envelope Index SQLite database and each message as an .emlx file, showing email sent, received and opened.
- Photos.sqlite: macOS Photos Library MetadataPhotos.sqlite in the macOS Photos library records each photo and video with capture time, location, import source, trash state and original filename.
- iCloud Drive (CloudDocs): macOS Sync Folders and DatabasesiCloud Drive local folders and the CloudDocs client.db and server.db databases that list synced files, versions and the devices that wrote them.
- Shell History on macOS: zsh, bash and Terminal SessionsmacOS shell history in .zsh_history, .bash_history and Terminal's per-window session files: which commands a user typed and roughly when.
- Wi-Fi Known Networks on macOS: Plists and LogsmacOS known Wi-Fi networks in com.apple.wifi.known-networks.plist, airport preferences, wifi.log and Unified Logs: where a Mac has connected, and when.
- Bluetooth Devices on macOS: Paired and SeenmacOS Bluetooth artifacts: com.apple.Bluetooth.plist, MobileBluetooth device plist and LE databases, and bluetoothd logs to show which devices paired and when.
- USB Devices: macOS Removable Media HistorymacOS keeps no USB registry: rebuild removable media history from Unified Logs, DiskArbitration mounts, FSEvents, Spotlight and the device itself.
- Apple Notes NoteStore.sqlite: macOS Notes ForensicsNoteStore.sqlite holds Apple Notes on macOS: note text as compressed protobuf, folders, accounts, attachments, locked notes and Recently Deleted items.
- Calendar, Contacts and Reminders Databases on macOSWhere macOS stores Calendar events, Contacts (AddressBook .abcddb) and Reminders, and what they show about meetings, relationships and tasks.
- Saved Application State: macOS Window and Terminal HistorymacOS Saved Application State (.savedState) restores windows at relaunch and keeps window titles, open documents and even Terminal scrollback text.
- QuickLook Thumbnail Cache: macOS File Preview EvidenceThe QuickLook thumbnail cache (index.sqlite and thumbnails.data) records files previewed in Finder, with paths, hit counts and cached images.
- Microsoft Office and Outlook for Mac: MRU and Mailbox DataOffice for Mac keeps recent-file lists in securebookmarks plists and MicrosoftRegistrationDB.reg; Outlook for Mac stores mail in a local profile database.
- Cloud Storage Clients on Mac: Dropbox, Drive, OneDriveDropbox, Google Drive and OneDrive on macOS keep sync databases, logs and File Provider folders that show which files were synced, shared or uploaded.
- iPhone Backups and Pairing Records on a MacFinder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.
- netusage.sqlite: macOS Per-Process Network Usagenetusage.sqlite records which processes used the network on a Mac, with first and last seen times and bytes over Wi-Fi, wired and cellular links.
- CUPS Print Jobs and Logs: macOS Printing ForensicsmacOS prints through CUPS: spool control files, page_log and access_log show which documents were printed, by whom, on which printer and when.
- macOS Trash and .DS_Store: Deleted File EvidenceThe macOS Trash keeps deleted files with their original location in .DS_Store put-back records, showing what a user deleted, from where and when.