How KnowledgeC records use

The system can answer "what was on screen" only if something recorded it. The public notes describe knowledgeC.db as that record: intervals of app use and a set of device states, written by CoreDuet. It is not the Messages database. What an examiner should and should not conclude is the other view of this topic.

What the feature is for

The 08/06/2018 mac4n6.com note treats the database as pattern-of-use data. The streams it demonstrates answer which app was in front (/app/inFocus), what activity an app reported (/app/activity), which Safari URL was visited (/safari/history), and, on iOS, states such as lock and battery. The 09/12/2018 follow-up lists a longer set of stream names from one iPhone, including /device/isLocked and /media/nowPlaying.

A stream is a string in ZSTREAMNAME. New kinds of events show up as new strings, not as new tables, in the queries those notes publish.

The structure

The August note uses three tables.

• ZOBJECT is the event. ZSTREAMNAME is the type. ZVALUESTRING is the app's bundle id for /app/inFocus, and the URL for /safari/history.
• ZSTRUCTUREDMETADATA holds extra columns for streams that need them. /app/activity is the note's example. It says the table has far more columns than one query should assume.
• ZSOURCE is the source of a row. The note joins it for a bundle id on some queries.

The APOLLO module knowledge_device_locked.txt reads /device/isLocked from ZOBJECT and maps ZVALUEINTEGER 0 to unlocked and 1 to locked. Its header names iOS 11 through 13 and the macOS versions it was written for. That is a query, not a promise that the integer means the same thing on every later system.

When a row is written

ZCREATIONDATE is when the note says the entry was written. ZSTARTDATE and ZENDDATE are the interval the event covers. All three use the Mac epoch, 01/01/2001 00:00:00 UTC. The note adds 978307200 to reach a Unix time. ZSECONDSFROMGMT stores the offset in seconds so a later reader can see the zone the device was set to.

The note says the ZOBJECT rows it looked at covered about four weeks. That figure is from the data in the article. It is not a retention setting documented for a current system.

An update dated 08/07/2018 says the write-up is specific to macOS 10.13 and iOS 11, and that iOS 10 kept the same kind of data with a different link between ZOBJECT and the metadata blob.

What changed, and what is open

On a Mac the note describes two databases, one for the system and one for the user. On iOS it describes a single file under /private/var/mobile/Library/CoreDuet/Knowledge/ that appears to merge them. The September note names that file knowledgeC.db and says an iTunes backup did not include it.

Paths, pitfalls, and the court limit are on the forensics view.