01Location
- /private/var/db/CoreDuet/Knowledge/knowledgeC.db
- ~/Library/Application Support/Knowledge/knowledgeC.db
02Questions it answers
- Which application was in focus, and for how long?
- When was the display on (backlit)?
- When was the device plugged in to power?
- Which Safari history entries were recorded in the /safari/history stream?
03Format and versions
| Format | SQLite 3 database. Main table ZOBJECT; ZSTARTDATE, ZENDDATE and ZCREATIONDATE are Mac absolute time (seconds since 2001-01-01 UTC). |
|---|---|
| Applies to | Published analysis covers macOS 10.13 and iOS 11. Streams and schema differ between releases; confirm what is populated on the examined version. |
04Key fields
| Field | What it tells you |
|---|---|
| ZOBJECT.ZSTREAMNAME | Stream name, for example /app/inFocus, /app/activity, /app/intents, /activity/level, /device/isPluggedIn, /display/isBacklit, /safari/history. |
| ZOBJECT.ZVALUESTRING | Value of the record, for example an application bundle identifier. |
| ZOBJECT.ZSECONDSFROMGMT | Offset from GMT in seconds stored with the record. |
| ZOBJECT.ZSTARTDAYOFWEEK | Day of week for the start time. |
| ZSOURCE, ZSTRUCTUREDMETADATA | Related tables holding the source and additional metadata of records. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZSTARTDATE, ZENDDATE | Mac absolute time: seconds since 2001-01-01 00:00:00 UTC | Add 978307200 for Unix seconds; the difference gives the duration. |
| ZCREATIONDATE | Mac absolute time: seconds since 2001-01-01 00:00:00 UTC | When the record was written, which can be later than ZENDDATE. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy the system and every user database with any -wal files.
- List the distinct ZSTREAMNAME values to see which streams this version populates.
- Convert ZSTARTDATE/ZENDDATE to UTC and compute durations per stream and value.
- Cross-check application focus periods against unified logs and file system activity.
07Interpretation pitfalls
- The published analysis reports roughly four weeks of entries in ZOBJECT; older activity may not be present.
- Stream names and their meaning are inferred from research, not documented by Apple; validate on test systems.
- In-focus time shows an application was frontmost, not that a person was looking at it.
09Sources
- Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage Sarah Edwards, mac4n6.com (2018) · checked 2026-10-14
- ForensicArtifacts — artifacts/data/macos.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14