Sarah Edwards has posted her research of knowledgeC.db database. This database can be found on macOS and iOS devices. On Mac systems there is a system context database located in the /private/var/db/CoreDuet/Knowledge directory, and a user context database is located in the user’s ~/Library/Application Support/Knowledge/ directory. On iOS there is only one main knowledgeC.db database located in /private/var/mobile/Library/CoreDuet/Knowledge/. Full post can be found here.
Home Tips & Tricks Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage
-
Threat Hunting: What it Is, and What it Is Not
Nowadays everybody is talking about threat hunting. Everyone wants to be a threat hunter. … -
Looking at Microsoft Teams from a DFIR Perspective
David Cowen’s Sunday Funday is back, so why not to take part in this fun? Last Sunda… -
SQM: New Evidence of Execution Source?
Forensicating one of compromised hosts during our recent incident response activities we h…
Load More Related Articles
-
Finding Registry Malware Persistence with RECmd
Chad Tilbury has writen a post on how to use Eric Zimmerman’s RECmd and its batch fi… -
Detecting PowerShell Empire Shenanigans with Sysinternals
In this post Ben Bornholm writes about how to detect PowerShell Empire using the tools fro… -
Analyzing the Windows LNK File Attack Method
An interesting post by D3xt3r’s Malware Laboratory describing another example of usi…
Load More In Tips & Tricks
Comments are closed.
