KnowledgeC

Evidence: KnowledgeC
Description: Collect KnowledgeC Database
Category: System
Platform: macos
Short Name: kcdb
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes

KnowledgeC is a macOS database that stores user activity data including application usage, device connections, media playback, location data, and system events. It’s part of Apple’s CoreDuet framework used for Siri suggestions and system intelligence.

This collector gathers structured data about knowledgec.

This collector gathers the KnowledgeC database and related files from each user’s Library/Application Support/Knowledge directory, which contains comprehensive user activity tracking data.

KnowledgeC is extremely valuable for forensic investigations, providing detailed user activity timelines, application usage patterns, device connections, location history, and user behavior analysis. It’s one of the richest data sources on macOS for understanding user actions.