What KnowledgeC records about use

How to read this

This entry reviews evidence published by other people. The author did not test any tool or examine any device for it. Blocks marked with an evidence class quote or summarize a source; sentences beginning “we” describe what the author did with those sources, which was to read them. Anything DEVI could not confirm is marked as such and left as an open question rather than written up as a finding. Sources change without notice, which is why the verification date is stated.

knowledgeC.db is a log of use: which app was in front, a slice of what that app was doing, and a set of device states. It is not the message a person sent, and it is not a browser history file, even when one of its streams records a Safari URL.

What the record shows

A stream name is the note's word for the type of row. /app/inFocus is which app was in front. /safari/history is a URL visited in Safari, and the note says those rows are removed when the person clears Safari history, and that private browsing did not appear.

Where it lives

The notes do not say a current iOS backup still omits the file. That limit is not independently verified for later systems.

How to read it

The notes read it as SQLite. The August 2018 note uses ZOBJECT as the main table and joins ZSTRUCTUREDMETADATA and ZSOURCE when the stream needs them. Times are Mac epoch, 01/01/2001 00:00:00 UTC. The note converts them by adding 978307200 and then treating the sum as a Unix time.

The public APOLLO module knowledge_device_locked.txt in the mac4n6/APOLLO repository does that conversion for /device/isLocked, and it labels ZVALUEINTEGER 0 as unlocked and 1 as locked. The module's header lists iOS 11, 12, and 13, and macOS 10.15, 10.16, and 14. It does not speak for every later system.

What the fields mean

From the August 2018 note, for the columns it actually uses:

• ZSTREAMNAME: the type, such as /app/inFocus or /safari/history.
• ZVALUESTRING: for /app/inFocus, the bundle id of the app. For /safari/history, the URL.
• ZSTARTDATE and ZENDDATE: the start and end of the interval, in Mac epoch seconds.
• ZCREATIONDATE: when the entry was written.
• ZSTARTDAYOFWEEK: 1 for Sunday through 7 for Saturday, in that note's query.
• ZSECONDSFROMGMT: the offset from GMT, in seconds.
• ZSTRUCTUREDMETADATA: a pointer at extra columns. For /app/activity the note reads an activity type and a title. It says that table has many more columns than the query uses.
• ZSOURCE: a pointer at source columns such as a bundle id.

The note says ZOBJECT on the data it examined held on the order of four weeks of rows. That is a description of that data, not a retention rule for a current phone.

Pitfalls

The schema moved between iOS 10 and iOS 11, by the note's own update. A query written for one will fail or lie on the other.

/app/inFocus is graphical apps. Time in a terminal is time in Terminal, not time in every command. A long com.apple.loginwindow interval on a Mac can be a closed laptop, not a person at the keyboard.

A Safari URL in this database is a second copy. Clearing history clears it, and private browsing was absent in the note. It does not replace Safari's own history file.

Activity blobs can contain the substance of a chat or a map search, on the systems the note examined. They can also be easy to skip, because a viewer shows them as a blob until someone opens them. That is still not the Messages database.

Device time is the clock the phone was using. The notes do not discuss a person setting the clock wrong. Treat a timestamp as what the device recorded, and check it against another artifact before calling it the civil time.

How it holds up in court

A usage interval shows that this database recorded an app in front, or a device state, for that span. It does not show the content of a message, and it does not identify a person on a shared Mac without more work. The August 2018 note says user attribution on macOS is the hard part, because the system copy is not already tied to one account.

The Legal Questions Around Mobile Device Extraction Are Not One Question is a source review of search and access. It is not a ruling about this database.