01Location
- /private/var/mobile/Library/Biome/streams/{restricted|public}/<StreamName>/local/<file>
- /private/var/mobile/Library/Biome/streams/…/<StreamName>/remote/<remoteId>/<file>
- /private/var/db/biome/… (system equivalents)
- /private/var/mobile/Library/Biome/sync/sync.db
02Questions it answers
- Which app, Wi-Fi, Bluetooth, notification or browsing events were recorded on iOS 15+ devices?
- When was each record written, and was it later marked deleted?
- Which data replaces knowledgeC streams that are empty on newer iOS?
03Format and versions
| Format | SEGB container files named with a number representing creation time. v1: 56-byte header ending with "SEGB"; records with 32-byte headers holding two timestamps. v2: 32-byte header starting with "SEGB", an entries count and creation time; a trailer of 16-byte records (end offset, state 1 written / 3 deleted, timestamp). Payloads are commonly protobuf, sometimes layered with plists. |
|---|---|
| Applies to | Biome's binary format appeared in iOS 15, was unchanged in iOS 16 and was revised (SEGB v2) in iOS 17. Stream names vary by release, e.g. App.Install, _DKEvent.App.Install, _DKEvent.Safari.History, _DKEvent.Wifi.Connection, Device.Wireless.Bluetooth, public/Notification. |
04Key fields
| Field | What it tells you |
|---|---|
| Stream folder name | Identifies the data type, e.g. _DKEvent.App.Install or Device.Wireless.WiFi. |
| Entry state | 1 = written, 3 = deleted (v2 trailer). |
| Entry payload | Usually a protobuf message whose fields differ per stream. |
| sync.db | SQLite database in Biome/sync read by iLEAPP for Biome sync information. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| SEGB entry timestamp(s) | Apple Cocoa time (64-bit float, seconds since 2001-01-01 UTC) | Decoded as Cocoa time by the CCL SEGB parser used in iLEAPP. |
| v2 header creation time | Apple Cocoa time (64-bit float) | File creation time stored in the header. |
| Payload time fields | Varies by stream | Some protobuf fields hold their own times; iLEAPP converts App.Install payload times by adding 978,307,200 (Cocoa epoch). Confirm per stream. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect the full Biome directory tree, keeping stream folder names and local/remote structure.
- Detect SEGB v1 or v2 per file from the header layout.
- Parse entries with their state and timestamps; keep deleted entries separately.
- Decode payloads per stream and validate field meanings against documented research.
- Correlate with knowledgeC.db, app databases and system logs.
07Interpretation pitfalls
- Biome is only available in full file-system extractions.
- Payload schemas are undocumented by Apple; integers without a documented meaning should be reported as stored.
- Tombstone folders hold bookkeeping data, not event records, in iLEAPP's tests.
09Sources
- Understanding and decoding the newest iOS SEGB format Shai Shapira, Cellebrite (2023) · checked 2026-10-14
- Hidden gems in Apple iOS digital forensics Johan Persson, MSAB (2024) · checked 2026-10-14
- iLEAPP — scripts/ccl_segb/ccl_segb1.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iLEAPP — scripts/ccl_segb/ccl_segb2.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iLEAPP — scripts/artifacts/biomeAppinstall.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iLEAPP — scripts/ilapfuncs.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14