Media Now Playing

Evidence: Media Now Playing
Description: Collect Media Now Playing
Category: System
Platform: macos
Short Name: medianp
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The KnowledgeC now-playing stream records media playback events with the playing application and, where available, the track title, artist, and album.

This collector gathers structured data about media now playing, including the application, media metadata, and timing. Results are recorded in media_now_playing.

This collector reads KnowledgeC databases under user profiles and records now-playing events into media_now_playing.

Media playback ties a user to the device at specific times and can reveal applications and content in use during an incident window.