- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Independent forensic reconstruction of macOS user activity: which apps were used, which files were opened, which searches were run, which sites were visited, and when — anchored to specific user accounts with per-second precision.
Quick Answer. macOS User Activity Forensics reconstructs a user’s interaction with a Mac from a defined set of high-value artifacts: KnowledgeC.db (~/Library/Application Support/Knowledge/knowledgeC.db) records app foreground/background streams, screen-lock, battery, and Now Playing; CoreDuet (~/Library/Application Support/CoreDuet/) records intent and interaction; Spotlight shortcuts and metadata index recent searches; TCC.db records privacy consent; com.apple.recentitems.plist lists recently opened files. Each artifact ties activity to a specific user account with high-resolution Mach absolute or CFAbsolute timestamps.
~/Library/Application Support/Knowledge/knowledgeC.db is a SQLite database populated by duetexpertd. It stores tens of thousands of records per user typically spanning ~30 days. The core stream types include:
/app/inFocus — bundle identifier of the frontmost app, with start / end timestamps/app/activity — app-declared activity (document title, URL, activity type)/app/usage — cumulative usage of an app in a window/app/webUsage — URLs the user actively viewed inside Safari/display/isBacklit — whether the display was on/device/isLocked — whether the device was locked/device/isPluggedIn — power state/media/nowPlaying — currently playing media, title, artist/user/notificationCenter — notifications the user receivedTimestamps are stored in Mac Absolute Time (seconds since 2001-01-01 UTC). Joining ZOBJECT to ZSTRUCTUREDMETADATA and ZSOURCE reveals per-app document titles and URLs. This is the record that establishes what the user was looking at, second-by-second.
The CoreDuet subsystem records higher-order interactions: contacts communicated with, apps predicted for launch, and Handoff activity across devices signed into the same iCloud account. Key files include ~/Library/Application Support/CoreDuet/People/interactions.db, ~/Library/CoreDuet/Knowledge/, and the CoreDuetContext plists in ~/Library/Application Support/CoreDuet/Context. Together with KnowledgeC.db, they answer “when did this user last communicate with this person, from which app, on which device?”
~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.RecentDocuments.sfl2 — recent documents system-widecom.apple.LSSharedFileList.RecentApplications.sfl2 — recently launched applicationscom.apple.LSSharedFileList.RecentServers.sfl2 — mounted SMB/AFP/NFS shares with URL and timestampcom.apple.LSSharedFileList.RecentHosts.sfl2 — RDP / SSH targets~/Library/Preferences/com.apple.recentitems.plist — legacy recent items~/Library/Application Support/<app>/ — Word, Excel, Preview, TextEdit, Pages, Numbers, Keynotesfl2 files are Apple Property List binary containing NSKeyedArchiver payloads referencing Bookmark objects with resolved paths and volume metadata. Bookmarks survive file moves and even removable volumes.
Spotlight indexes user documents with rich kMDItem* attributes (author, downloaded date, WhereFroms URL, last used date). mdls on a preserved image reveals these attributes without altering the file. ~/Library/Metadata/CoreSpotlight/ and the volume-level .Spotlight-V100 store also expose recent searches and query history.
~/Library/Application Support/com.apple.TCC/TCC.db (per-user) and /Library/Application Support/com.apple.TCC/TCC.db (system) record every consent decision: camera, microphone, screen recording, accessibility, full disk access, location, contacts, calendars, and reminders. Each row includes the client bundle ID, service, granted status, prompt count, and timestamps. In matters involving screen capture, keystroke logging, or covert audio, TCC is often decisive.
Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.
Frequently yes. /app/activity donations include document titles and URLs, and /app/inFocus establishes the exact seconds the app was frontmost. Combined with the file’s LSSharedFileList bookmark and mdls attributes, we tie a specific document to a specific viewing window.
Approximately 30 days by default. Users cannot easily prune it, and older records often survive in APFS local snapshots and Time Machine backups.
Yes, once decrypted at acquisition. FileVault is a full-volume encryption layer; once mounted with the recovery key or credentials, all user-space artifacts (KnowledgeC.db, Spotlight, TCC.db, sfl2 files) are readable.
Tell us about the Mac, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder