84 Streams Later: Exploring the Evolution of Apple Biome in iOS
Over the last few years, Apple's Biome framework has quietly evolved into one of the most important sources of forensic evidence available on iOS devices. While the forensic community has traditionally focused on artifacts such as KnowledgeC.db, Apple has progressively shifted a significant amount of behavioral, contextual, and predictive information into Biome.
Today, most forensic analysts are aware of Biome and the SEGB/SEGBv2 file formats, and many commercial and open-source tools provide at least limited support for some of the available streams. However, after working on multiple real-world investigations, I realized that several fundamental questions remained surprisingly difficult to answer:
- When exactly did Apple introduce the SEGB format and the Biome framework?
- How did the storage locations evolve across different iOS versions?
- To what extent has Biome replaced KnowledgeC?
- How well do modern forensic tools actually support the available data?
This article attempts to answer those questions by combining previously published research with a practical review of acquisitions spanning multiple generations of iOS.
Biome Is Not About Biometrics
The first obstacle when discussing Biome is its name.
Many investigators encountering it for the first time naturally assume that it is somehow related to biometric information. It is not.
One of the clearest explanations was provided by Howard Oakley in his June 2022 article"Biome isn't about biometrics, but suggestions." In essence, Biome is Apple's framework for collecting and maintaining information that can be used to improve the user experience through predictions, recommendations, Siri intelligence, proactive suggestions, and personalization features.
From a forensic perspective, this immediately makes Biome interesting.
Anything the operating system remembers in order to anticipate user behavior is likely to contain valuable evidence about that user's activities.
As several researchers have noted over the years, Biome appears to have gradually assumed many of the responsibilities historically associated with KnowledgeC.db, which for years represented one of the most valuable behavioral artifacts available to forensic analysts.
The Early Research
The first significant forensic research related to Biome was published by John Hyla in March 2022.
His article focused on the AppIntent stream, which at the time was stored within:
/private/var/mobile/Library/Biome/streams/public/
Hyla analyzed the file format, identified meaningful offsets, and demonstrated that valuable user activity information could be extracted from these files.
A few months later, Geraldine Blay expanded the community's understanding significantly.
While analyzing iOS notification data, she observed that the same file format was being used within:
/private/var/mobile/Library/DuetExpertCenter/streams/userNotificationEvents/local
More importantly, her research identified the "SEGB" signature contained in the file header, which ultimately gave the format the name commonly used by forensic analysts today.
Her work demonstrated that the format was not limited to App Intent data but represented a broader storage mechanism used throughout iOS.
The findings were subsequently republished through DFRWS Review, helping bring wider visibility to the artifact.
Later in 2022, following the release of iOS 16, Scott Vance published the excellent Breaking Down the Biomes series. Those articles documented numerous streams present within the Biome ecosystem and significantly expanded the forensic community's knowledge of the available artifacts.
Together, these studies laid the foundations of modern Biome analysis.
SEGBv2 and the Evolution of the Format
The next major milestone arrived with the release of iOS 17.
Apple introduced substantial changes to the file structure, resulting in what is commonly referred to as SEGBv2.
These modifications required researchers and forensic vendors to revisit their parsers and update their decoding methodologies.
One of the most useful public analyses of the new format was published by Cellebrite, which documented the differences between SEGB and SEGBv2 and helped the forensic community maintain visibility into these artifacts.
By the end of 2023, the industry had largely become aware that a growing amount of user activity data was being stored inside SEGB and SEGBv2 files.
What remained unclear was how this ecosystem had evolved historically.
When Did Apple Introduce Biome?
To answer this question, I reviewed a collection of public datasets, internal testing acquisitions, and real-world forensic images spanning multiple versions of iOS.
iOS 13 (September 2019 – August 2020)
Across all examined datasets running iOS 13, I found no evidence of SEGB files or Biome streams as we know them today.
KnowledgeC remained heavily populated and continued to be Apple's primary repository for behavioral data.
iOS 14 (September 2020 – August 2021)
iOS 14 is the earliest version where I consistently observed files stored using the SEGB format.
The following locations were present:
/private/var/mobile/Library/Biome/streams/public
/private/var/mobile/Library/DuetExpertCenter/streams/- various stream folders
At this stage, user notification artifacts were not yet observed.
Biome appears relatively simple compared to later versions, but this is clearly where the framework begins to emerge.
iOS 15 (September 2021 – August 2022)
With iOS 15, the ecosystem expanded significantly.
SEGB files were observed in:
/private/var/mobile/Library/Biome/streams/publicrestricted
/private/var/mobile/Library/DuetExpertCenter/streams/- various stream folders
userNotificationEvents
This version aligns closely with Geraldine Blay's findings regarding notification artifacts.
It is also the first version in which Biome begins to feel like a mature repository rather than an experimental feature.
iOS 16 (September 2022 – October 2023)
iOS 16 introduced another important change.
For the first time, a dedicated system-level Biome repository appeared.
The following locations were observed:
/private/var/db/biome/streams/restricted
/private/var/mobile/Library/Biome/streams/publicrestricted
/private/var/mobile/Library/DuetExpertCenter/streams/- various stream folders
userNotificationEvents
The introduction of the system-level repository strongly suggests that Apple was increasing its reliance on Biome as a core framework for collecting and maintaining contextual intelligence data.
iOS 17 Through iOS 26 (September 2023 – July 2026)
With iOS 17, Apple introduced SEGBv2 and slightly reorganized the storage structure.
Across all examined datasets from iOS 17 through iOS 26, the following locations were consistently present:
/private/var/db/biome/streams/restricted
/private/var/mobile/Library/Biome/streams/restricted
/private/var/mobile/Library/DuetExpertCenter/streams/- various stream folders
userNotificationEvents
One notable change is the disappearance of the previously observed public Biome area.
For modern investigations involving devices from the last three years, these locations should be considered priority targets during any full filesystem examination.
Taken together, these findings provide a clear picture of Apple's gradual expansion of the Biome ecosystem. What began in iOS 14 as a relatively limited implementation evolved into one of the operating system's primary repositories of behavioral and contextual information.
The Gradual Replacement of KnowledgeC
To better understand the significance of Biome, it is useful to compare its evolution with that of KnowledgeC.db.
For years, KnowledgeC represented one of the richest sources of behavioral evidence available on Apple devices. Ian Whiffin's excellent research documents the numerous streams historically stored within the database and the tremendous forensic value they provided.
When reviewing historical datasets, a clear trend emerged.
In iOS 13, KnowledgeC contained more than fifty distinct streams.
In iOS 14 and iOS 15, that number increased further, exceeding sixty-five streams.
Starting with iOS 16, however, the situation changed dramatically.
The number of active KnowledgeC streams dropped to approximately twenty.
At the same time, Biome continued to expand.
Some artifacts appear duplicated between KnowledgeC and Biome, while others seem to have migrated almost entirely into the Biome ecosystem.
Although Apple has never publicly documented this transition from a forensic perspective, the historical evidence strongly suggests that Biome gradually became the preferred repository for a large portion of the contextual and behavioral information previously maintained within KnowledgeC.
Notifications: A Brief Historical Note
No article discussing SEGB would be complete without mentioning notification artifacts.
The notification streams initially documented by Geraldine Blay became particularly valuable to investigators because they could preserve data that was no longer available within the originating application.
This topic received significant public attention in April 2026 when reports emerged that investigators had been able to recover Signal message content from Apple's internal notification storage, even after Signal had been removed from the device.
Shortly after the publication of those reports, Apple addressed the issue and released a fix.
According to Apple's security advisory, a logging issue could result in notifications marked for deletion being unexpectedly retained on the device. The issue was fixed through improved data redaction.
How Well Do Forensic Tools Support Biome?
To answer the final question, I adopted a practical approach.
I processed multiple forensic images using both commercial and open-source tools and evaluated the resulting artifact extraction.
My conclusion is simple:
Current support for Biome is generally good, but still limited.
Most tools support somewhere between ten and twenty Biome streams.
At first glance this may appear adequate.
However, the reality looks very different when examining a modern iOS device.
On iOS 26, a standard device contains more than 300 stream folders under:
/private/var/mobile/Library/Biome/streams/
The gap between what exists and what is currently parsed is substantial.
Looking Beyond Existing Tool Support
Curious about what investigators might be missing, I began manually reviewing the contents of all available streams.
Using a Full File System acquisition from my own iPhone running iOS 18, together with three real-world forensic images running iOS 18 and iOS 26, I systematically analyzed every stream located within the two primary Biome repositories.
The results were revealing.
The system-level repository contained approximately forty streams.
The user-level repository contained more than three hundred.
Across the four devices examined, I identified:
- 16 streams within
/private/var/db/biome/streams/that consistently contained relevant forensic artifacts. - 68 streams within
/private/var/mobile/Library/Biome/streams/that contained potentially valuable evidence.
Combined, this resulted in 84 streams containing useful forensic information.
Many of the identified streams contained data related to:
- Application usage
- Application installation events
- Safari activity
- Location visits
- Notification activity
- Wallet transactions
- CarPlay usage
- Screen Time information
- Wireless connectivity
- Power and battery state changes
- Siri interactions
- Message-related activity
- Keyboard usage
- Apple Intelligence activity
- Media playback information
The level of detail available within some of these streams is genuinely impressive.
Bringing the Findings to iLEAPP
After identifying the streams that consistently contained relevant information, I shared the findings with my friend Alexis Brignoni, Team Lead of the LEAPP project.
I provided both the list of streams and the associated test datasets.
Alexis was phenomenal.
Within less than two days, using both my test data and his own validation datasets, he created parser support for the newly identified streams and integrated them into iLEAPP.
The result is a dramatic increase in the amount of Biome data accessible to investigators using the latest version of the tool.
Anyone interested in seeing the impact of this work should compare the output generated by the latest release against a version of iLEAPP released before the additional Biome support was introduced.
The difference is immediately apparent.
Not All Streams Retain Data for 28 Days
A common assumption is that Biome data is typically retained for approximately 28 days.
My experience suggests that this is only partially true.
While many streams do appear to operate on roughly four-week retention periods, others preserve information for significantly longer periods, in some cases extending for several months.
This greatly increases their forensic value.
Among all the streams examined, two stood out as particularly interesting:
- Siri.Remembers.MessageHistory
- Location.Visit
Both contain exceptionally rich contextual information and deserve dedicated future research.
A final note of caution: the existence of a parser should never be confused with full understanding of an artifact.
Although Alexis and I developed support for a large number of streams, the interpretation of individual records must still be validated through experimentation, testing, and correlation with other sources of evidence.
Final Thoughts
Three years after the forensic community first began documenting Biome artifacts, it has become clear that Apple has transformed the framework into one of the most important repositories of behavioral evidence available on modern iOS devices.
The evidence suggests that:
- SEGB first appeared in iOS 14.
- Biome expanded significantly during iOS 15 and iOS 16.
- SEGBv2 became the standard format with iOS 17.
- KnowledgeC gradually lost many of its historical streams as Biome matured.
- Modern devices contain hundreds of Biome streams.
- Current forensic tools only support a fraction of the available data.
Most importantly, the fact that I identified meaningful information in 84 streams out of more than 340 does not mean the remaining streams are irrelevant. It simply means that, in the datasets I examined, they did not immediately reveal obvious forensic value.
There is still an enormous amount of unexplored territory inside Biome.
If there is one lesson to take away from the last several years of research, it is that curiosity remains one of the most powerful tools available to a forensic examiner.
Download the latest version of iLEAPP, run every available Biome parser against a Full File System acquisition, compare the results with older releases, and start exploring.
There is a very good chance that the next important Biome discovery has not yet been made!
Comments
Post a Comment