iOS
KnowledgeC:
https://www.magnetforensics.com/blog/analysis-of-graykey-images-with-axiom-new-knowledgec-database-artifact-additions/
• /private/var/mobile/Library/CoreDuet/Knowledge/ knowledgeC.db
Screentime:
-
/private/car/mobile/Library/Application
-
Support/com.apple.remotemanagementd/
-
RMAdminStore-Local.sqlite
Snapshots:
• /private/var/mobile/Library/Containers/Data/ Application/[APPGUID]/Library/Splashboard/ Snapshots/