Screen Time
Apple Screen Time configuration and activity — restrictions, downtime, users, devices, installed apps, ask-for-time requests, notification counts, and pickups.
- Status
- available
- CLI plugin
- system.screentime
- Categories
- system, user
Overview
Screen Time aggregates which apps a user opened, for how long, and how many times — across every Apple device signed into the same Apple ID. Even when the user has never explicitly enabled Screen Time in System Settings, the underlying database still records usage. For investigators it's an alternative timeline of user behaviour that's harder for a subject to think about clearing.
The system.screentime plugin parses restrictions, downtime, users, devices, installed apps, ask-for-time requests, notification counts, pickups, and settings. Per-app usage durations and category totals are parsed by Pattern of Life.
Analysis Tips
- Usage durations:
ZUSAGEBLOCKandZUSAGETIMEDITEMhold per-app durations. Use Pattern of Life for these records - Restrictions and downtime: Show what limits were set on the account, and when
- Cloud sync:
RMAdminStore-Cloud.sqlitelists the user's other devices, users, installed apps, and ask-for-time requests - Pickups and notifications: Parsed from the local database only; track how often the device was picked up and notifications received
- Retention: ~30 days locally, longer in iCloud
Related Artifacts
- Pattern of Life - KnowledgeC and Biome cover the same usage with different granularity
- Unified Logs - Cross-reference app launch events
- TCC Database - Apps that appear in Screen Time should also be reflected in TCC
References
Data sources
~/Library/Application Support/com.apple.ScreenTimeAgent/Store/
Restrictions, downtime, users, devices, installed apps, notification counts, pickups, and settings
~/Library/Application Support/com.apple.ScreenTimeAgent/Store/
iCloud-synced Screen Time data — restrictions, users, devices, installed apps, and ask-for-time requests