RSS Feed


Created: 07.10.2023

This article is an attempt to summarise different resources about knowledgeC database and highlight its main forensically valuable information. The database typically includes about one month of records.


Type: SQLite Path 📂: macOS system db /private/var/db/CoreDuet/Knowledge, macOS user db ~/Library/Application Support/Knowledge/, iOS /private/var/mobile/Library/Coreduet/Knowledge/.

Information of forensic value:

  1. App usage. (timestamps, duration and frequency). Similar to prefetch data?
  2. Internet activity. (browsing history and queries). Useless when history is explicitly deleted by the user or when the user is surfing via the private mode.
  3. Calls and texts. Timestamps, numbers and call duration.
  4. Device state. Battery, charging events, connected devices, backlight etc.
  5. Media. Audio and video I/O devices + interactions with photos and videos.

⚠️ *On iOS 16+ and MacOS 13+, Apple devices store most device statistics in the 🏺 Biome database instead of the 🏺 knowledgeC.db file. ⚠️ You need full file system access to acquire it, since it’s not included in the backups.



Each activity tracked.


Additional info


Additional info on the source.


  1. Belkasoft article, iOS System Artifacts: Revealing Hidden Clues
  2. Sarah’s article on KnowledgeC anatomy and usage
  3. Belkasoft iOS course
  4. Belkasoft iOS KnowledgeC article