Skip to content
KnowledgeC Parser

Posts tagged: #dfir

← Back to all posts
knowledgeC.db Location and How to Collect Biome Streams
Where knowledgeC.db and Biome streams live on macOS, and how to collect them with Terminal, UAC, Velociraptor or a disk image without losing the WAL.
knowledgecbiomeacquisitionuac
knowledgeC.db Forensics: The Complete macOS Guide
What knowledgeC.db records on macOS, where it lives, how ZOBJECT and its streams work, how to convert its timestamps, and what the data does not prove.
knowledgecmacos-forensicsbiomesqlite
knowledgeC vs Biome: Where macOS Records App Usage
knowledgeC.db or Biome? How the two macOS activity stores differ, which Biome stream matches which knowledgeC stream, and what to expect on recent releases.
knowledgecbiomemacos-forensicsapp-usage
knowledgeC.db-wal: Recovering Recent Events from the WAL
Why recent knowledgeC events often exist only in knowledgeC.db-wal, how SQLite WAL frames, salts and checkpoints work, and how to read added or removed rows.
knowledgecsqlite-walmacos-forensicsdata-recovery