KnowledgeC
Also called knowledgeC.db, CoreDuet, macOS application usage database.
- PLATFORM
- macOS
- CATEGORY
- Program Execution
- INDEX
- 20 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
A macOS database of user-activity streams recording which applications were in focus and for how long, when the display was lit, and when the device was locked.
Where it lives
~/Library/Application Support/Knowledge/knowledgeC.db for the user, and a system-level database under /private/var/db/CoreDuet/Knowledge/
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of knowledgec” is neither.
What it records
The knowledge store keeps event streams with start and end times: application launch and usage, which application held focus, display backlight state, device lock state, and in some versions web usage associated with an application. Each event is an interval, so the database supports statements about how long something was in use rather than only that it happened. Content and stream availability differ by macOS release, and access to the system-level database is restricted by platform protections on modern versions.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- Which applications were used, when, and for how long, with per-user attribution from the user-level database
- Whether the machine was awake, unlocked, and being interacted with during a given period — often the cleanest evidence that a person was physically present
- Sequences of application focus that reconstruct a working session in order
- Web usage associated with an application on versions that record it, which can survive after browser history is cleared
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- Which human was at the machine. Display state and focus show that someone was interacting with the account's session, not who
- What was done inside an application. Focus intervals carry no document paths and no content
- Anything beyond the retention window, which is a rolling period on the order of a month and varies by release — the database is not an archive
- Consistent facts across macOS versions. Streams have been added, renamed and removed between releases, so a field relied on for one system may not exist on another
- That the absence of a stream means the activity did not occur, particularly where platform protections prevented collection of the system-level database
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Establishing the retention window and showing the events at issue predate it
- Pointing to release-to-release changes in the schema and asking whether the tool was validated for the macOS version examined
- Arguing that interaction evidence attaches to a session rather than to a named person
- Questioning whether the acquisition captured the system-level database at all, given the access restrictions on modern macOS
What survives, and for how long
Events are pruned on a rolling window measured in weeks, so this is a short-window artifact whose value depends on prompt preservation. It survives reboots but not time, and the database can be deleted by the account holder.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What does knowledgeC.db show on a Mac?
It records user-activity streams as intervals: which applications were launched and in focus, for how long, when the display was lit, and when the device was locked. That makes it the standard macOS source for showing that someone was actively using the machine during a particular period, and for reconstructing the order of a working session.
How far back does KnowledgeC data go?
Roughly a month, as a rolling window, with the exact behaviour varying by macOS release. It is a working store for system features rather than an archive, so events age out continuously. In a matter where the conduct is months old, the database is usually empty of anything relevant by the time the Mac is imaged — which makes preservation timing decisive.
Can KnowledgeC prove who was using the computer?
It can show that someone was interacting with a particular account's session — the display was lit, the device was unlocked, an application held focus — which is often the closest a Mac gets to placing a person at the keyboard. It names an account, not a person. Bridging that gap requires evidence from outside the machine, such as badge records or video.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
macOS Unified Logs
The macOS system-wide log stream, recording process launches, device attachment, authentication and application behaviour in extraordinary detail for a short period.
Spotlight Metadata Store
The macOS metadata index, holding per-file attributes including last-used dates, use counts, and the URL a downloaded file came from — often for files that no longer exist.
FSEvents
A per-volume macOS log of directory-level change notifications recording that paths were created, renamed, modified or removed — ordered by event identifier rather than by clock time.
Windows Timeline (ActivitiesCache)
A per-user database recording application usage and the documents opened in each application, with start and end times and, where account sync was on, activity from the user's other devices.
Whether the knowledgecevidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.