https://www.knowledgecparser.com/en/blog Latest from Blog en Wed, 30 Sep 2026 00:50:48 GMT https://www.knowledgecparser.com/en/blog/analyze-knowledgec-biome-in-browser https://www.knowledgecparser.com/en/blog/analyze-knowledgec-biome-in-browser Step-by-step: load knowledgeC.db with its -wal and Biome SEGB streams into a free in-browser parser, set a time range, review sessions and export a timeline. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/biome-segb-file-format https://www.knowledgecparser.com/en/blog/biome-segb-file-format Byte-level reference for Biome SEGB v1 and v2: headers, trailers, record states, CRC32, alignment, file-name times and protobuf field numbers per stream. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/knowledgec-biome-location-acquisition https://www.knowledgecparser.com/en/blog/knowledgec-biome-location-acquisition Where knowledgeC.db and Biome streams live on macOS, and how to collect them with Terminal, UAC, Velociraptor or a disk image without losing the WAL. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/knowledgec-db-forensics-guide https://www.knowledgecparser.com/en/blog/knowledgec-db-forensics-guide What knowledgeC.db records on macOS, where it lives, how ZOBJECT and its streams work, how to convert its timestamps, and what the data does not prove. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/knowledgec-vs-biome-macos https://www.knowledgecparser.com/en/blog/knowledgec-vs-biome-macos knowledgeC.db or Biome? How the two macOS activity stores differ, which Biome stream matches which knowledgeC stream, and what to expect on recent releases. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/knowledgec-wal-recovery https://www.knowledgecparser.com/en/blog/knowledgec-wal-recovery Why recent knowledgeC events often exist only in knowledgeC.db-wal, how SQLite WAL frames, salts and checkpoints work, and how to read added or removed rows. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.knowledgecparser.com/en/blog/who-was-at-the-keyboard-macos https://www.knowledgecparser.com/en/blog/who-was-at-the-keyboard-macos Rebuild unlocked sessions on a Mac from lock, backlight, power and app focus records in knowledgeC.db and Biome, and learn what they cannot prove. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT