04 · User Activity
knowledgeC.db and Biome: Reconstructing Mac User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
04 · Evidence area
Pattern-of-life data answers the questions interviews cannot: which app was in focus, which file came from which URL, what was searched and browsed. This area covers knowledgeC.db, the newer Biome SEGB streams, Spotlight metadata and Safari history.
3 guides in this area
04 · User Activity
Where knowledgeC.db and Biome store app usage, focus and device state on macOS, how to query ZOBJECT with correct time conversion, and what Biome changed.
04 · User Activity
How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS.
04 · User Activity
Analyze Safari History.db, Downloads.plist, bookmarks and session files on macOS, plus Chrome and Firefox locations, epochs and SQL queries.
Where each artifact lives, what it proves, its timestamps and the tools to parse it.