iPhone KnowledgeC and Biome Forensics: Behavioral Timeline Reconstruction

Quick Answer. KnowledgeC is Apple’s on-device behavioral database at /private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db. It records discrete user and system events — every foreground app switch, every screen lock and unlock, every notification, every Siri invocation, every Bluetooth pair — as rows in ZOBJECT with start/end timestamps. Since iOS 15 the Biome framework has extended this with per-stream event stores under /private/var/mobile/Library/Biome/. Together they produce a minute-by-minute record of who did what with the phone.

knowledgeC.db streams (ZSTREAMNAME) that matter

Reading a ZOBJECT row

Each row carries ZSTARTDATE and ZENDDATE in Core Data time (seconds since 2001-01-01 UTC), ZVALUESTRING (the payload, e.g. bundle ID), ZSOURCE and ZUUID. For /app/inFocus, the delta between start and end is the exact foreground session length. We extract every stream over the case window, plot events on a common timeline, and expose gaps that indicate power-off, airplane mode, or possible tampering.

Biome — iOS 15+ behavioral extensions

Biome stores per-stream event blobs in Signposts under /private/var/mobile/Library/Biome/streams/ and consolidated in /private/var/mobile/Library/Biome/persisted/. Notable streams include ApplicationLaunch, ApplicationInstall, SiriRequests, DeviceUnlock, Communications, WebPageVisit, Notification. Where KnowledgeC has been cleared or capped, Biome frequently retains the same events for longer periods.

What this proves in a case

• Exactly when the user unlocked the device and for how long
• Which app was open and for how many seconds
• Which URLs Safari visited (correlates with Safari History)
• Which Siri commands were spoken (with transcript in some builds)
• When the device was plugged in — corroborates location and presence
• Which contacts the user interacted with, by app

This is often the single most decisive iOS artifact set in disputes over whether the phone’s user (as opposed to an app or a background process) took a given action.

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned iPhone forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the iPhone Forensics hub for the full analytical framework we bring to every matter.

Related iPhone forensics pages

Frequently asked questions