Add macOS KnowledgeC and Network Usage parsers - #138
Merged
Merged
Conversation
KnowledgeC (knowledgeC.db, read from both the system store and the per-user store, tagged by Source File): app in focus, app usage, web usage, Safari history, app intents, notification usage, media playing, display backlit, device locked, and device plugged in. Network Usage (netusage.sqlite): per-process app data (ZLIVEUSAGE/ZPROCESS). Timestamps are Mac Absolute Time (Core Data) in UTC; the -wal sidecars are read alongside each database. The knowledgeC.db and netusage.sqlite research is credited to Sarah Edwards (mac4n6.com) in each artifact's notes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
abrignoni
force-pushed
the
feat/macos-knowledgec-netusage
branch
from
September 15, 2026 00:29
edba77e to
b32ed39
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds macOS KnowledgeC and Network Usage support for DLEAPP.
Timestamps are Mac Absolute Time in UTC; the -wal sidecars are read alongside each database. Queries adapted from iLEAPP and Sarah Edwards APOLLO, cited in each artifact notes. Validated against the public macOS Big Sur test image (Josh Hickman, thisisdfir), read as a raw E01 with -t raw and cross-checked with -t fs; counts in each sample_data. Network Usage connections is empty on that image (its tables hold no rows) and reports nothing.
🤖 Generated with Claude Code