Glossary
knowledgeC.db
knowledgeC.db is the CoreDuet SQLite database where macOS records pattern-of-life events such as app focus, screen state and lock state as streams.
knowledgeC.db is a SQLite database written by Apple's CoreDuet framework. It records "pattern of life" events as intervals, each tagged with a stream name such as /app/usage, /app/inFocus, /display/isBacklit or /device/isLocked, and stored as rows of the ZOBJECT table.
A Mac has two copies: the system database at /private/var/db/CoreDuet/Knowledge/knowledgeC.db (owned by root, restricted by SIP) and a per-user database at ~/Library/Application Support/Knowledge/knowledgeC.db (protected by TCC, so the collecting process needs Full Disk Access). Both run in WAL mode: collect knowledgeC.db-wal and knowledgeC.db-shm with the main file, or the most recent events can be missing.
Retention is roughly four weeks, and recent macOS releases have moved several streams, including app focus, to Biome. See the knowledgeC.db forensics guide.