← All artifacts

Pattern of Life

Behavioural analytics from KnowledgeC, Biome, Screen Time, InteractionC, and DuetActivityScheduler — tracking app usage, device activity, and interaction patterns.

Status
available
CLI plugin
system.patternoflife
Categories
system, user

Overview

Pattern of Life artifacts collectively reconstruct detailed user behaviour — which apps were used, when the device was active, who was contacted, and what content was consumed. KnowledgeC and Biome are the primary sources, with Screen Time providing usage duration summaries and InteractionC tracking cross-app communication patterns over extended retention periods.

Analysis Tips

  • KnowledgeC vs Biome: KnowledgeC is primary on macOS 10.15–12; Biome takes over on macOS 13+. Both may coexist
  • Dynamic metadata: KnowledgeC's ZSTRUCTUREDMETADATA table has 100+ Z_DK* columns that vary by stream type — enumerate dynamically
  • SEGB formats: v1 (macOS 12–13) uses 56-byte headers; v2 (macOS 14+) uses 32-byte headers with trailer sections
  • InteractionC retention: Unlike KnowledgeC's ~28 day rolling window, InteractionC retains 6+ months of cross-app interaction data
  • Screen Time: ZUSAGEBLOCK with ZUSAGETIMEDITEM provides per-app usage duration breakdowns
  • Biome streams: Key streams include AppLaunch, NowPlaying, SafariPageView, Notification, and SleepMode

Related Artifacts

  • Messages - InteractionC tracks messaging interaction patterns
  • FaceTime - Call interactions reflected in InteractionC
  • Safari Browser - Biome SafariPageView stream captures browsing activity

References

Data sources

knowledgeC.dbSQLite (Core Data)

/private/var/db/CoreDuet/Knowledge/

App usage, device activity, and network events (~28 day rolling)

knowledgeC.dbSQLite (Core Data)

~/Library/Application Support/Knowledge/

Per-user activity events

SEGB stream filesSEGB binary + protobuf

~/Library/Biome/streams/

Biome behavioural streams — primary on macOS 13+ (~28 day rolling)

RMAdminStore-Local.sqliteSQLite (Core Data)

~/Library/Application Support/com.apple.ScreenTimeAgent/Store/

Screen Time usage blocks and per-app durations

interactionC.dbSQLite (Core Data)

/private/var/db/CoreDuet/People/

Cross-app interaction records with 6+ month retention

DuetActivitySchedulerData.dbSQLite

/private/var/db/DuetActivityScheduler/

Background task scheduling records