Skip to content
KnowledgeC Parser

Series

Investigating with knowledgeC and Biome

3 posts in this series. Read them in order or jump to any one.

  1. How to Analyze knowledgeC.db and Biome in Your Browser

    Step-by-step: load knowledgeC.db with its -wal and Biome SEGB streams into a free in-browser parser, set a time range, review sessions and export a timeline.

  2. knowledgeC.db-wal: Recovering Recent Events from the WAL

    Why recent knowledgeC events often exist only in knowledgeC.db-wal, how SQLite WAL frames, salts and checkpoints work, and how to read added or removed rows.

  3. Who Was Using the Mac? A knowledgeC and Biome Method

    Rebuild unlocked sessions on a Mac from lock, backlight, power and app focus records in knowledgeC.db and Biome, and learn what they cannot prove.

All posts in this series

How to Analyze knowledgeC.db and Biome in Your Browser
Step-by-step: load knowledgeC.db with its -wal and Biome SEGB streams into a free in-browser parser, set a time range, review sessions and export a timeline.
knowledgecbiometoolshow-to
knowledgeC.db-wal: Recovering Recent Events from the WAL
Why recent knowledgeC events often exist only in knowledgeC.db-wal, how SQLite WAL frames, salts and checkpoints work, and how to read added or removed rows.
knowledgecsqlite-walmacos-forensicsdata-recovery
Who Was Using the Mac? A knowledgeC and Biome Method
Rebuild unlocked sessions on a Mac from lock, backlight, power and app focus records in knowledgeC.db and Biome, and learn what they cannot prove.
knowledgecbiomeuser-activitytimeline