Device Plugged In State

Evidence: Device Plugged In State
Description: Collect Device Plugged In State
Category: System
Platform: macos
Short Name: devplug
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The KnowledgeC plugged-in stream records when the device was connected to or disconnected from power, building a charging timeline that reflects physical location and usage habits.

This collector gathers structured data about whether the device was plugged into power and the associated timing. Results are recorded in device_plugged_in.

This collector reads KnowledgeC databases under user profiles and records device power-state events into device_plugged_in.

Power state transitions correlate with the user being at a desk or travelling, helping place the device and user on a timeline.