Logs, events, and user interaction
At the start of this chapter, we introduced pattern-of-life forensics, and we learned how iOS stores and analyzes a number of user events and device events. Then, we went through the most common sources of data, such as the KnowledgeC.db database, and learned how iOS represents time through Unix timestamps and Mac absolute time.
Now, we'll take an in-depth look at one of the most forensically interesting SQLite databases you will find on an iOS device.
The KnowledgeC database
KnowledgeC.db is the SQLite database that tracks almost all activity and device events, ranging from battery level to what music was played. The database is located at /private/var/mobile/Library/CoreDuet/Knowledge/, and it is only accessible through a full filesystem acquisition. The database is made of 16 tables, although most of the useful data is concentrated in one of them, the ZOBJECT table.
The following screenshot shows the database schema:
