Technical Overview
The KnowledgeC database is part of Apple’s CoreDuet framework, which records information about how a user interacts with their device.
It is designed to improve system intelligence by learning user behaviour rather than storing application data directly.
Examples include:
- Frequently visited locations
- App usage patterns
- Device unlocks
- Charging habits
- Bluetooth connections
- Motion activity
- User routines
- Siri prediction data
- Suggested applications
- System events
Unlike application databases, KnowledgeC acts as a central repository of behavioural events collected from numerous system services.
Purpose
CoreDuet uses the KnowledgeC database to support features such as:
- Siri Suggestions
- Predictive app launching
- Intelligent battery charging
- Proactive shortcuts
- Widget recommendations
- “On This Day” memories
- Focus mode automation
- Apple Intelligence contextual awareness (newer iOS versions)
Database Location
On iOS the database is commonly located at:
/private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db
Additional files often include:
- knowledgeC.db-wal
- knowledgeC.db-shm
The Write-Ahead Log (WAL) may contain records not yet committed to the main database and is therefore important forensic evidence.
Database Structure
KnowledgeC is a SQLite database containing numerous tables, including:
- ZOBJECT
- ZSTRUCTUREDMETADATA
- ZSOURCE
- ZEVENT
- ZSTREAMNAME
- ZSYNCPEER
- ZVALUE
- ZMETADATA
Apple changes the schema between iOS releases.
Typical Artefacts
Application Usage
Records may show:
- Application launches
- Duration of use
- Foreground activity
- Background activity
- Time first opened
- Time last closed
These can establish user interaction with specific apps.
Device Unlock Events
Artefacts may include:
- Screen unlocked
- Screen locked
- Authentication events
- Passcode usage
- Biometric authentication
Useful for determining when the device was actively used.
Charging History
KnowledgeC may record:
- Charger connected
- Charger removed
- Battery percentage
- Charging duration
- Optimised charging behaviour
Motion Activity
Derived from device sensors:
- Walking
- Running
- Driving
- Cycling
- Stationary
This data may corroborate movement during an investigation.
Bluetooth Connections
Records can include:
- AirPods
- Vehicle infotainment systems
- Apple Watch
- Bluetooth speakers
- Other paired devices
These artefacts may help place a user in a particular vehicle or environment.
Location-Related Events
Although not a complete GPS history, KnowledgeC may contain:
- Significant locations
- Arrival events
- Departure events
- Region monitoring
- Visit events
These complement other sources such as Maps history or location caches.
Wi-Fi Activity
Possible artefacts include:
- Network joins
- Network departures
- SSID references
- Connectivity state changes
Siri Predictions
KnowledgeC stores behavioural information supporting Siri Suggestions, such as:
- Frequently used apps
- Regular contacts
- Common travel routes
- Routine activities
User Behaviour
One of the most valuable forensic aspects is the reconstruction of routines, including:
- Wake-up times
- Bedtimes
- Work schedule
- Home routine
- Exercise habits
- Daily commuting
Timestamps
KnowledgeC commonly stores timestamps in Apple’s Core Data absolute time format:
Seconds since 1 January 2001 00:00:00 UTC
Investigators must convert these to standard UTC or local time, taking time zones and daylight saving into account.
Correlation with Other Artefacts
KnowledgeC is most valuable when correlated with:
- App databases
- Call logs
- SMS/iMessage records
- Photos metadata
- Safari history
- Health data
- Maps history
- Bluetooth pairing records
- Wi-Fi logs
- Power logs
- Screen Time databases
- Unified logs
Cross-correlation strengthens evidential reliability.
Forensic Significance
KnowledgeC can help investigators:
- Establish when a device was actively used.
- Demonstrate whether a user opened a particular application.
- Reconstruct daily routines.
- Corroborate travel and movement.
- Identify likely periods of sleep or activity.
- Link Bluetooth accessories or vehicles to the device.
- Support or challenge timelines constructed from other evidence.
Because the database records behavioural events generated by the operating system rather than relying solely on user-created content, it is considered a high-value source of contextual evidence.
However, investigators should always corroborate KnowledgeC artefacts with additional sources, as records may be incomplete, subject to system updates, or affected by changes in Apple’s implementation across iOS and macOS versions.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
