KnowledgeC Complete(ish)
Ian Whiffin
Posted: 21th August 2023

This post shows some research I did as part of what was going to be a much bigger post that I started a long while ago related to iOS knowledgeC and attempts to show what every item was and meant.

It was a huge task, and one that I never completed. It's also one that has become less relevant over the last year as Apple moved towards the biome files and away from knowledgeC.

But I have been asked a couple of times about this type of data recently so I decided to post all my work here regardless. There are gaps and it's not a complete list, but this is as far as I got and hopefully it will come in useful to someone. I recommend validating most of this before relying on it though.

I may periodically update this document if I learn anything else.

 

The Data


/app/inFocus

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

Y

N

Y

This record is created when an application is being viewed on screen. Note that this can also be recorded when an app is shown within another app. For example, when in Messages and other applications can be accessed in order to share content.

The Z_DKAPPLICATIONMETADATAKEY__LAUNCHREASON field of the ZSTRUCTUREDMETADATA table affords more information including the following:

Actual UI Changes:

com.apple.springboard.lock-screen.scroll

From lock screen, user swipes left (to launch camera) or right (to launch widget screen)

com.apple.SpringBoard.transitionReason.appswitcher

App Launched using the app switcher (ie. viewing all open apps)

com.apple.SpringBoard.transitionReason.externalrequest

App Launched from another app (ie launching Google Maps from within Safari)

com.apple.SpringBoard.transitionReason.homescreen

App Launched by pressing app icon

com.apple.SpringBoard.transitionReason.spotlight

App Launched by using Spotlight to search

com.apple.SpringBoard.transitionReason.widget

App Launched from a widget

com.apple.SpringBoard.transitionReason.appLibraryCategory

App Launched from App Library

com.apple.SpringBoard.transitionReason.systemGesture

Only on iPhones without TouchID
Swiping left and right at the bottom of the screen will switch between apps.

com.apple.SpringBoard.transitionReason.siri

App Launched via Siri

com.apple.SpringBoard.transitionReason.controlcenter

App Launched from Control Center (ie launch timer or calculator)

com.apple.SpringBoard.transitionReason.breadcrumb

This artifact shows that the application regained focus from a child application. Ie. When using an application such as Maps and the user follows a WebSite link, Safari is launched and takes focus. However, there is a small breadcrumb button in the top left of the screen that allows the user to return to Maps.

com.apple.SpringBoard.transitionReason.notification

The application was launched from a received notification

Backlight Activity:

com.apple.SpringBoard.backlight.transitionReason.acPowerChange

Backlight changes due to being plugged in/unplugged.

com.apple.SpringBoard.backlight.transitionReason.idleTimer

Backlight changes due to being unused for X minutes and screen times out.

com.apple.SpringBoard.backlight.transitionReason.prox

Backlight changes due to proximity sensor (ie. the backlight goes off when you put the phone near your face during a call)

com.apple.SpringBoard.backlight.transitionReason.liftToWake

Backlight lights when lifted (and Lift to Wake is set)

com.apple.SpringBoard.backlight.transitionReason.lockButton

Backlight dims when Lock button pressed

com.apple.SpringBoard.backlight.transitionReason.touch

Backlight lights when screen is touched

com.apple.SpringBoard.backlight.transitionReason.externalRequest

Backlight lights as the result of an external request.

com.apple.SpringBoard.backlight.transitionReason.fullScreenAlert

Backlight lights when receiving a full screen alert such as an Alarm sounding.

If the application is launched as part of another app (called an Extension) then you can find the extension and parent application in the fields
Z_DKAPPLICATIONMETADATAKEY__EXTENSIONCONTAININGBUNDLEIDENTIFIER
Z_DKAPPLICATIONMETADATAKEY__EXTENSIONHOSTIDENTIFIER


/safari/history

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y

This record is created when Safari Mobile is used to access a webpage.
The ZSTARTDATE is the time the page was accessed.
The ZVALUESTRING is the URL that was visited.
The ZSTRUCTUREDMETADATA affords more information and may include the following:

Z_DKSAFARIHISTORYMETADATAKEY__TITLE

Webpage Title

Z_DKAPPLICATIONACTIVITYMETADATAKEY__TITLE

Webpage Title

Z_DKAPPLICATIONACTIVITYMETADATAKEY__ITEMRELATEDCONTENTURL

URL of the site being visited

Z_DKDIGITALHEALTHMETADATAKEY__WEBPAGEURL

URL of the site being visited


/app/install

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y

Note that seconds are ignored on these timestamps and all records will show as zero seconds.

There IS StructuredMetaData associated with this artifact.

This record type is made when an application is installed. The ZVALUESTRING value will give the application name that was installed.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKAPPINSTALLMETADATAKEY__PRIMARYCATEGORY

The type of app installed

Z_DKAPPINSTALLMETADATAKEY__TITLE

The “friendly” name of the app


/app/intents

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

Y

Y

Y

An “Intent” is a process used to pass information between two different applications. For example, pressing a link for a phone number in Safari will use an “intent” to start the Phone application and pass the phone number.

Using intents allows the device to maintain security and validate the type of data being passed between applications.

KnowledgeC can save intent data, including full text messages.

The ZVALUESTRING will detail what type of application is being requested by the intent (typically Calls or Messages).

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKINTENTMETADATAKEY__DIRECTION

1 = Send
2 = Receive

Z_DKINTENTMETADATAKEY__DONATEDBYSIRI

0 = Not from Siri
1 = From Siri

Z_DKINTENTMETADATAKEY__INTENTHANDLINGSTATUS

3 = Complete?
0 = Safari

Z_DKINTENTMETADATAKEY__INTENTTYPE

1 = Call/SMS
3 = Safari

Z_DKINTENTMETADATAKEY__INTENTVERB

StartCall
SendMessage
Engagement

Z_DKINTENTMETADATAKEY__SERIALIZEDINTERACTION

BPList containing the information about the intent. May include the full Text Message.

The ZSOURCE data may include the details of the third party.


/app/usage - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y

This record type is made when an application loses processor attention. In other words, the application does not need to be active to incur usage.


/app/webUsage

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y


This record is created when iOS is accessing the web.
The ZVALUESTRING is the application that was utilizing the web.
The ZSTRUCTUREDMETADATA affords more information and may include the following:

Z_DKSAFARIHISTORYMETADATAKEY__TITLE

Webpage Title

Z_DKAPPLICATIONACTIVITYMETADATAKEY__TITLE

Webpage Title

Z_DKAPPLICATIONACTIVITYMETADATAKEY__ITEMRELATEDCONTENTURL

URL of the site being visited

Z_DKDIGITALHEALTHMETADATAKEY__WEBPAGEURL

URL of the site being visited


/audio/outputRoute - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

Y

This record type is made when the device is utilizing audio.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKAUDIOMETADATAKEY__ROUTECHANGEREASON

0 = ??
1 = Headset Plugged in
2 = Headset Unplugged
3 = Call Activity
4 = User selected Speaker
8 = ??

Z_DKBLUETOOTHMETADATAKEY__DEVICETYPE

16 = ??
17 = ??
20 = ??

Z_DKAUDIOMETADATAKEY__PORTNAME

Eg.
Built-In Microphone
Built-In Receiver (earpiece speaker)
Speaker (Loud Speaker)
Headphones

Depending on device being used, may include Bluetooth MAC Address, BlueTooth Name and Protocol.

Z_DKAUDIOMETADATAKEY__IDENTIFIER

Z_DKAUDIOMETADATAKEY__PORTTYPE


/audio/inputRoute

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

Y

This record type is made when the device is utilizing audio.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKAUDIOMETADATAKEY__ROUTECHANGEREASON

0 = ??
1 = Headset Plugged in
2 = Headset Unplugged
3 = Call Activity
4 = User selected Speaker
8 = ??

Z_DKBLUETOOTHMETADATAKEY__DEVICETYPE

16 = ??
17 = ??
20 = ??

Z_DKAUDIOMETADATAKEY__PORTNAME

Eg.
Built-In Microphone
Built-In Receiver (earpiece speaker)
Speaker (Loud Speaker)
Headphones

Depending on device being used, may include Bluetooth MAC Address, BlueTooth Name and Protocol.

Z_DKAUDIOMETADATAKEY__IDENTIFIER

Z_DKAUDIOMETADATAKEY__PORTTYPE

/carplay/isConnected

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

Y

A record of this type is made whenever the device connects or disconnects to a CarPlay system.

If ZVALUEDOUBLE is 1 then the device was locked at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was unlocked at the ZSTARTTIME until the ZENDTIME.


/device/batteryPercentage

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

N

N

N

A record of this type is made whenever the device battery indication changes.

If ZVALUEDOUBLE is a reflection of the Battery Percentage being reported to the user.


/device/isLocked

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

A record of this type is made whenever the device is LOCKED or UNLOCKED with either the user passcode, TouchID or FaceID.
If ZVALUEDOUBLE is 1 then the device was locked at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was unlocked at the ZSTARTTIME until the ZENDTIME.


/device/isLockedImputed

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This is a very similar record to /device/isLocked. “Imputed” means that the value is inferred but it is found to be a duplicate to the isLocked.

A record of this type is made whenever the device is LOCKED or UNLOCKED with either the user passcode, TouchID or FaceID.

If ZVALUEDOUBLE is 1 then the device was locked at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was unlocked at the ZSTARTTIME until the ZENDTIME.


/device/isPluggedIn

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

Maybe

A more appropriate term for this artifact may be “isCharging” as a record of this type is made whenever the device is charging, and this applies equally to being physically plugged in or placed onto a Wireless Charging device.

If ZVALUEDOUBLE is 1 then the device was charging at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device stopped charging at the ZSTARTTIME until the ZENDTIME.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKDEVICEISPLUGGEDINMETADATAKEY__ADAPTERISWIRELESS

0 = FALSE
1 = TRUE

Z_DKDEVICEISPLUGGEDINMETADATAKEY__ADAPTERTYPE

-536854521 = ???

-536723453 = Qi Wireless Charger

-536854524 = Non-Apple Certified Cable using Power Only

-536854525 = Apple Certified Cable using Power Only

-536854528 = Apple Certified Cable using Power & Data

 


/device/lowPowerMode

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

A record of this type is made whenever the device enters or exits Low Power Mode.

If ZVALUEDOUBLE is 1 then the device was in Low Power Mode at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was not in Low Power Mode at the ZSTARTTIME until the ZENDTIME.


/device/batterySaver

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

Y

A record of this type is made whenever the user selects to enter Battery Saver Mode (ie. Low Power Mode).

If ZVALUEDOUBLE is 1 then the device was in Battery Saver Mode at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was not in Battery Saver Mode at the ZSTARTTIME until the ZENDTIME.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKBATTERYSAVERMETADATAKEY__SOURCE

Details the method used to invoke Battery Saver Mode.


/display/isBacklit

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

A record of this type is made whenever the device backlight illuminates or dims.

If ZVALUEDOUBLE is 1 then the device backlight was illuminated until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device backlight was off at the ZSTARTTIME until the ZENDTIME.


/display/orientation

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

A record of this type is made whenever the device orientation change results in a change to the display. This means that simply reorientating the phone while on the home screen will not have any affect. However, if the user is in an app that responds to orientation changes, such as Safari, then a record will be created.

If ZVALUEDOUBLE is 0 then the device was portrait.
If ZVALUEDOUBLE is 1 then the device was landscape.
If ZVALUEDOUBLE is 2 then the device was portrait. The difference here is that this value will only appear at boot up of the device.


/keybag/isLocked

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This is a very similar record to /device/isLocked.

A record of this type is made whenever the device is LOCKED or UNLOCKED with either the user passcode, TouchID or FaceID.

If ZVALUEDOUBLE is 1 then the device was locked at the ZSTARTTIME until the ZENDTIME.
If ZVALUEDOUBLE is 0 then the device was unlocked at the ZSTARTTIME until the ZENDTIME.


/media/nowPlaying

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

Y

N

Y

This type of artifact is recorded when there is a change in the media playing state. This could be when the media starts playing when it pauses or is closed.

The ZVALUESTRING will detail the application that was playing the media being referenced.
The ZSTARTDATE and ZENDDATE relate to the time the media was in the state being reported.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKNOWPLAYINGMETADATAKEY__PLAYING

0 = Stopped
1 = Playing
2 = Paused
3 = Loading
4 = Interruption (ie. call)

Z_DKNOWPLAYINGMETADATAKEY_ISAIRPLAYVIDEO

Documents if the media is being streamed via Airplay
1 = YES
0 = NO

Z_DKNOWPLAYINGMETADATAKEY__ARTIST

The Artist who created the media.

Z_DKNOWPLAYINGMETADATAKEY__ALBUM

The Album from which the media is from.

Z_DKNOWPLAYINGMETADATAKEY__TITLE

The Title of the media.

Z_DKNOWPLAYINGMETADATAKEY__DURATION

The duration of the media item.

Z_DKNOWPLAYINGMETADATAKEY__OUTPUTDEVICEIDS

A BPList which identifies how the media was outputting the audio. Ie. Speaker, Headphones etc.


/photos/share/all

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This record indicates that a single media item was shared via the Photos App.
Sending multiple items does not create this record.
This record may be accompanied with a secondary record /photos/share/airdrop or /photos/share/extension.


/photos/share/airdrop

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This type of artifact is recorded when airdrop is used to send a single media item via airdrop.

It does not matter if the recipient accepts or denies the airdrop. A record will be created on the sending device either way.

Sending multiple items via AirDrop does not create this record.

The ZSTARTTIME & ZENDTIME values are equal to the end of the AirDrop operation.


/photos/share/extension

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This records indicates that the image/video was shared to another application such as Messages, WhatsApp, Books etc.


/sharesheet/feedback

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

Y

N

Y

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKSHARESHEETSUGGESTIONMETADATAKEY__SOURCEBUNDLEID

The application doing the sharing

Z_DKSHARESHEETSUGGESTIONMETADATAKEY__TARGETBUNDLEID

The receiving application

Note that there may be bplist blobs found in and Z_DKSHARESHEETFEEDBACKMETADATAKEY__MODELSUGGESTIONPROXIES.Z_DKSHARESHEETFEEDBACKMETADATAKEY__ATTACHMENTS These bplists contain the suggested options for the user to share with. For example, it may populate with the contact with whom the user shares things the most. The bplists can not be used to see who did receive the item.


/system/airplaneMode

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This artifact is created when AirPlane Mode is enabled or disabled.

The ZSTARTDATE is the time the status changed and the ZENDDATE is when the status changed again.

If ZVALUEDOUBLE is 0 then Airplane Mode is OFF.
If ZVALUEDOUBLE is 1 then Airplane Mode is ON.


/userInteraction/appDirectory

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

N

N

Y

This record type is created when the user enters the AppDirectory.

The ZVALUEDOUBLE appears to be related to activity within the AppDirectory.

0 = Load
4 = Launch App
7 = Search Mode
9 = Close Started
8 = Return to Home Screen


/wifi/connection

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

Y

N

N

This artifact is recorded whenever a WiFi connection is ended.

The ZSTARTDATE refers the to the time that the WiFi Connection was started.
The ZENDDATE refers the to the time that the WiFi Connection was terminated.
The ZVALUESTRING is the SSID of the connected WiFi Network.


/mapsShareEta/feedback

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

Y

Y

This artifact is recorded whenever the user shares their ETA with another person.

The ZVALUESTRING is the address of the person being sent the eta information (ie.their phone number)

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKMAPSSHAREETAFEEDBACKMETADATAKEY__CONTACTID Ties to the GUID of the contact in the ABPerson table of AddressBook.

This record will be followed up with an AppIntent which includes the location information being shared.


/settings/doNotDisturb

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This artifact is recorded whenever the Do Not Disturb status changes.

This could be caused via interaction from the user, the scheduled Do Not Disturb mode or while driving etc.

The ZVALUEDOUBLE is related to the state.

0 = Do Not Disturb is OFF.
1 = Do Not Disturb is ON.


/bluetooth/isConnected

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

Y

This artifact is recorded whenever a Bluetooth device is connected/disconnected.

The ZVALUEDOUBLE is related to the state.
1 = Connected
0 = Disconnected

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKBLUETOOTHMETADATAKEY__DEVICETYPE

16 = ??
17 = ??
20 = ??

Z_DKBLUETOOTHMETADATAKEY__ISAPPLEAUDIODEVICE

Is it an Apple Device?
1 = True
0 = False

Z_DKBLUETOOTHMETADATAKEY__ISUSERWEARING

A more accurate description appears to be “Is User Wearable”
1 = True
0 = False

Z_DKBLUETOOTHMETADATAKEY__ADDRESS

Bluetooth MAC Address

Z_DKBLUETOOTHMETADATAKEY__NAME

Bluetooth Device Name


/siri/ui

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

Y

N

N

This artifact is recorded when Siri User Interface either begins or ends.

The ZVALUESTRING documents if the UI was starting or ending.


/siri/intentEvent

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y

This artifact is an App Intent specific to Siri.

The ZSTRUCTUREDMETADATA affords more information including the following:


Z_DKINTENTMETADATAKEY__SERIALIZEDINTERACTION

This is a bplist presented as a Blob.
Inside the BPList is a Base64 encoded bplist which may contains the users request to Siri.


/siri/service

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

Y

N

Y

This artifact is recorded when Siri User Interface either begins or ends.

The ZSTRUCTUREDMETADATA affords more information including the following:


Z_DKINTENTMETADATAKEY__SERIALIZEDINTERACTION

This is a bplist presented as a Blob.
Inside the BPList is a Base64 encoded bplist which may contains the users request to Siri.


/notification/usage

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

Y

This artifact is created whenever a notification is received to the device such as a message.

The ZVALUESTRING value documents how the notification was handled.

Receive

Recorded for all notifications upon receipt.

DefaultAction

The notification was pressed by the user and the default action (ie. Open message occurred)

Clear

The user cleared the notification(s).

IndirectClear

The notification was cleared. This may be as a result of the user Clearing the notification (in which case it should be preceeded by a “clear” event or as the result of another action on the device.

Hidden

This is never shown to the user

Dismiss

The user dismissed the notification by swiping up on it.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKNOTIFICATIONUSAGEMETADATAKEY__BUNDLEID

The app that received the notification

In some cases, the notification may be followed by an App Intent with relevant content such as the message content.


/dasd/batterytemperature

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

N

N

N

This artifact appears to be made when the temperature of the batter changes.

The ZVALUEDOUBLE is the battery temperature in milligrade (thousandth of a degree) ie. A value of 3000 would be 30.0 centigrade.

The temperature can be affected by internal factors (such as heavy processor use or battery charging) as well as external factors such as ambient temperature.


/photos/engagement/0To1Seconds

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

N

This artifact appears is created when the user views a photo in the photo gallery for between 0 and 1 second.


/photos/engagement/1To2Seconds

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

N

This artifact appears is created when the user views a photo in the photo gallery for between 1 and 2 seconds.


/photos/engagement/2To3Seconds

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

N

This artifact appears is created when the user views a photo in the photo gallery for between 2 and 3 seconds.


/inferred/focusMode

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This artifact is created when the device changes the Focus Mode of the device.

The ZVALUESTRING shows the Focus Mode that has been activated.

Examples include DRIVING, GAMING and DEFAULT.


/dasd/widgetRefresh

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This artifact is created when the users’ widgets get updated. This may be as the result of user actions (such as scrolling to the Today View) but can also happen without user activity when the device is unlocked.

The ZVALUESTRING shows the widget that caused the record to be created.


/dasd/widgetView (/widgets/viewed)

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This artifact appears to document which widgets were on screen, not necessarily the widgets that were interacted with.

The ZVALUESTRING shows the widget that caused the record to be created.

These records are made en-masse every few minutes rather than at the time that the action occurred. This can be see from the ZCREATIONDATE field.


/user/isFirstBacklightOnAfterWakeup

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This is another artifact that documents the backlight status of the screen. It is not as granular as /display/isBacklit as it doesn’t record every on/off event.

The ZVALUEDOUBLE shows the widget that caused the record to be created.


/airplay/prediction - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

Y

N

N

Y

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKAIRPLAYPREDICTIONMETADATAKEY__OUTPUTDEVICEID

Speaker

Z_DKAIRPLAYPREDICTIONMETADATAKEY__SUBTYPE

autoroute
existing-route


/photos/deletes/all

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

N

This type of artifact is created when a single photo is deleted from the photo gallery.

  • Note that it doesn’t matter if the photo is being viewed and deleted or deleted from the roll gallery view.
  • The record is made when the user confirms deletion.
  • In this case, “Deletion” refers only to marking the photo for deletion (where it goes to the Recently Deleted folder for 30 days)
  • Selecting and deleting multiple records does not create this artifact.

/photos/deletes/recent - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

N

N

N

N


/app/locationActivity

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

Y

Y

This type of artifact is created when Apple Maps is used to search for a location or navigation is being used.

Note

  • The locations are the locations of the target of the search and NOT the device.
  • Note that the Timestamps ignore seconds, showing 00 for all.

The ZVALUESTRING shows the application responsible for the record.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__LATITUDE

Latitude related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__LONGITUDE

Longitude related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__URL

URL related to the location request

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__CITY

City related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__COUNTRY

Country related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__DISPLAYNAME

Friendly name related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__FULLYFORMATTEDADDRESS

Full address related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__LOCATIONNAME

Name related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__POSTALCODE_V2

Postal Code related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__STATEORPROVINCE

State or Province related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__SUBTHOROUGHFARE

Subthroughfare / address number related to the location data

Z_DKLOCATIONAPPLICATIONACTIVITYMETADATAKEY__THOROUGHFARE

Main road related to the location data


/inferred/motion - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N


/event/tombstone - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This record is created when the device runs the tombstone process related to memory management. This is an internal process that does not require user interaction to occur.

The ZSTRUCTUREDMETADATA affords more information including the following:

Z_DKTOMBSTONEMETADATAKEY__EVENTSTREAMNAME

The application that was subject to the tombstone function.


/charging/smartTopOffEngagement

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N

This record is occurs when the device starts charging when the device is already at or near 100% charge.


/activity/level - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

Y

Y

N

N

N

This record is created when the type of activity that the device is doing changes.

The ZVALUEDOUBLE relates to the type of activity being performed.

0

Device is sleeping and doing nothing.

1

Device is awake

4

 

8

Device is sleeping but is processing in the background (such as playing music or monitoring for Noise Recognition)

16

 

17

 


/dasd/controlEffort

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N

This record appears without any activity from the user. DASD stands for Duet Activity Scheduler Daemon which is basically a manager for the scheduling of background tasks.
This occurs just after the device is unplugged


/dasd/activityProfile

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

Y

N

N

This record appears without any activity from the user. DASD stands for Duet Activity Scheduler Daemon which is basically a manager for the scheduling of background tasks.

The ZVALUESTRING is the name of the process, such as com.apple.message.db.vacuum or com.apple.mediaanalysisd.photos.face


/system/TLC - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N


/photos/deletes/all

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N

This record occurs when the user deletes a single photo/video/screenshot from the Photos application. This record will may be paired with a secondary record such as /photos/deletes/recent or /photos/deletes/old.
Note that the record is purged when the photo is deleted from the “Recently Deleted” album.


/photos/deletes/recent

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N

This record occurs when the user deletes a single, recently taken photo/video/screenshot from the Photos application.
Note that the record is purged when the photo is deleted from the “Recently Deleted” album.


/photos/deletes/old

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

N

This record occurs when the user deletes a single, old taken photo/video/screenshot from the Photos application. “Old” appears to mean any item that is older than 6 months.
Note that the record is purged when the photo is deleted from the “Recently Deleted” album.


/inferred/microLocationVisit - INCOMPLETE RESEARCH

ZStartDate

ZEndDate

ZValueDouble

ZValueString

ZSource

ZStructuredMetaData

Y

N

N

N

N

Y


 

Wrapping Up

knowledgeC was an extremely useful database with a tonne of information all easily at your fingertips.

Much of the information is still available via the biome files, but it's certainly not as easy to work with.

Previous Article
"Location Accuracy"
Next Article
"BrowserState.db last_viewed_time?"
Search
Social