Skip to content
KnowledgeC Parser

Glossary

Full Disk Access

Full Disk Access is the macOS TCC permission a collector needs to read the user knowledgeC.db and the Biome streams on a running Mac, and what it leaves out.

Full Disk Access is a macOS privacy permission managed by TCC (Transparency, Consent and Control). An app that holds it can read user data TCC otherwise protects, including ~/Library/Application Support/Knowledge/knowledgeC.db and ~/Library/Biome/. In the TCC database the grant appears as the service kTCCServiceSystemPolicyAllFiles.

For live collection, the process that copies the files needs this permission: Terminal, the host of the collection script, or the triage tool. Without it, access to those paths is refused.

Granting it is recorded in the TCC database of the Mac under examination, so note when you granted it and to which app. Full Disk Access does not lift System Integrity Protection, which guards the system copies of knowledgeC.db and Biome. Collection steps are in where knowledgeC.db and Biome live and how to collect them.