01Location
- /private/var/wireless/Library/Databases/DataUsage.sqlite
02Questions it answers
- Which apps or processes used network data?
- How many bytes went over Wi-Fi versus cellular?
- When was a process first and last recorded?
03Format and versions
| Format | Core Data SQLite. ZPROCESS lists processes (ZBUNDLENAME, ZPROCNAME); ZLIVEUSAGE holds counters linked by ZHASPROCESS. |
|---|---|
| Applies to | Some stores lack Wi-Fi columns; iLEAPP then reads only ZWWANIN/ZWWANOUT. |
04Key fields
| Field | What it tells you |
|---|---|
| ZPROCESS.ZBUNDLENAME / ZPROCNAME | Bundle identifier and process name (iLEAPP shows the part before the first '/'). |
| ZLIVEUSAGE.ZWIFIIN / ZWIFIOUT | Bytes received/sent over Wi-Fi. |
| ZLIVEUSAGE.ZWWANIN / ZWWANOUT | Bytes received/sent over cellular (WWAN). |
| ZLIVEUSAGE.ZKIND | Undocumented kind value; iLEAPP excludes 257 and reports others as stored. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZPROCESS.ZFIRSTTIMESTAMP | Apple Cocoa time (seconds since 2001-01-01 UTC) | First time the process was recorded. |
| ZPROCESS.ZTIMESTAMP | Apple Cocoa time | Process record timestamp. |
| ZLIVEUSAGE.ZTIMESTAMP | Apple Cocoa time | Usage entry timestamp; counters are cumulative values, not single transfers. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Check which counter columns exist in ZLIVEUSAGE.
- Join ZLIVEUSAGE to ZPROCESS and convert all three timestamps.
- Compare first-seen times with app installation and usage artifacts.
07Interpretation pitfalls
- Byte counters do not reveal content, destinations or individual sessions.
- ZKIND semantics are not documented.
09Sources
- iLEAPP — scripts/artifacts/DataUsage.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14