Device Locked State

Evidence: Device Locked State
Description: Collect Device Locked State
Category: System
Platform: macos
Short Name: devlock
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The KnowledgeC device locked stream records when the device screen was locked or unlocked over time, building a timeline of physical presence at the machine.

This collector gathers structured data about device lock and unlock state and timing. Results are recorded in device_locked.

This collector reads KnowledgeC databases under user profiles and records device lock state events into device_locked.

This evidence shows when a user was physically present and interacting with the device, corroborating or contradicting other activity during an incident window.