01Location
- /private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db
02Questions it answers
- Which app was in use and for how long?
- When was the device locked or unlocked and the screen backlit?
- What media was playing, and when was the device charging?
03Format and versions
| Format | SQLite. Main table ZOBJECT, with ZSTRUCTUREDMETADATA and ZSOURCE holding context. ZSTREAMNAME gives the record type (e.g. /app/usage, /device/isLocked, /display/isBacklit, /media/nowPlaying, /device/isPluggedIn, /device/batteryPercentage). |
|---|---|
| Applies to | Described for iOS 11 by Edwards (iOS 10 schema differs). iLEAPP test data show several streams (e.g. battery, plugged-in) empty on iOS 16.1.1–26.5.2 images, where Biome carries comparable data. |
04Key fields
| Field | What it tells you |
|---|---|
| ZOBJECT.ZSTREAMNAME | Stream (record type). |
| ZOBJECT.ZVALUESTRING / ZVALUEINTEGER | Bundle ID or URL, or an integer state (e.g. 0 unlocked / 1 locked per APOLLO for iOS 11–14). |
| ZSTRUCTUREDMETADATA | Stream-specific details, e.g. now-playing artist/title, plug adapter info. |
| ZSOURCE | Source context related to the entry. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZSTARTDATE / ZENDDATE | Apple Cocoa time (seconds since 2001-01-01 UTC) | Interval of the event; add 978,307,200 for Unix time. |
| ZCREATIONDATE | Apple Cocoa time | When the entry was written, which can differ from the event interval. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Inventory the stream names present on the image before choosing queries.
- Join ZOBJECT to ZSTRUCTUREDMETADATA for streams that store details there.
- Convert start, end and creation dates separately and keep all three.
- On iOS 16 and later, check Biome streams for the same activity.
07Interpretation pitfalls
- Edwards reports roughly four weeks of ZOBJECT data; older activity may be absent.
- App usage reflects GUI applications; an empty stream on newer iOS is not by itself evidence about the device.
- Value labels from APOLLO were written for iOS 11–14; report other values as stored.
09Sources
- Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage Sarah Edwards, mac4n6.com (2018) · checked 2026-10-14
- iLEAPP — scripts/artifacts/knowledgeC.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- Hidden gems in Apple iOS digital forensics Johan Persson, MSAB (2024) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14