Calendar & Reminders

Overview

The Calendar & Reminders collector captures events, participants, locations, and scheduling data from both Apple Calendar and Reminders. Calendar uses a plain SQLite database (not Core Data), while Reminders uses per-account Core Data databases. The collector uses dynamic column detection to support macOS 10.12 and later.

Analysis Tips

• Calendar vs Reminders: Calendar.sqlitedb is plain SQLite (no Z-prefix tables); Reminders databases are Core Data with Z-prefix tables requiring Z_PRIMARYKEY entity resolution
• Suggested events: SuggestedEventInfo contains travel bookings and reservations automatically extracted from email
• Participant analysis: The Participant and Identity tables reveal meeting attendees and their responses
• Location data: Location table contains GPS coordinates and addresses for events
• Legacy support: On macOS 10.12–10.14, Calendar Cache in ~/Library/Calendars/ is parsed when the modern databases are not present
• Dynamic schema: Use PRAGMA table_info() to discover available columns — schemas vary across macOS versions

Core Data Timestamps

Both Calendar and Reminders use Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC):

Core Data timestamp = Unix timestamp - 978307200

Related Artifacts

• Contacts - Calendar participants link to contact records
• Mail - Suggested events extracted from email content
• Pattern of Life - Calendar activity reflected in KnowledgeC

References

• Apple EventKit Documentation