ZENA FORENSICS

Following my recent research into Apple's Biome ecosystem, I continued examining additional artifacts located within the DuetExpertCenter framework. Although much of the recent forensic attention has focused on the SEGB file format and, in particular, on the notification-related streams located within: /private/var/mobile/Library/DuetExpertCenter/streams/ it seemed reasonable to assume that additional notification-related artifacts might exist elsewhere within the same framework. This assumption proved correct. During the analysis of several iOS full filesystem acquisitions, I identified an SQLite database named: /private/var/mobile/Library/DuetExpertCenter/streams/notificationAndSuggestionDB.db At first glance, the database appeared relatively small and unremarkable. A closer inspection, however, revealed a valuable artifact for forensic investigations. The "notifications" Table Among the various tables present in the database, the most interesting is undoubtedly "n...

Following my previous article, 84 Streams Later: Exploring the Evolution of Apple Biome , this article takes a deeper look at the work performed during the analysis, with the goal of enabling further research into the various Biome streams identified throughout the investigation. As described in the previous post, on iOS 17 and later systems, Biome streams are primarily stored in two locations:  /private/var/db/biome/streams/restricted/ /private/var/mobile/Library/Biome/streams/restricted/ The analysis of these folders across multiple devices—including personal devices, test devices, and real-world forensic acquisitions—allowed the identification of 84 streams containing information that may be of forensic interest. Based on the observed content, I categorized the streams according to the type of information they contain. To simplify the analysis, I identified five categories of information: Device State (e.g., Airplane Mode on/off, device plugged in, battery level, and similar inf...

Over the last few years, Apple's Biome framework has quietly evolved into one of the most important sources of forensic evidence available on iOS devices. While the forensic community has traditionally focused on artifacts such as KnowledgeC.db , Apple has progressively shifted a significant amount of behavioral, contextual, and predictive information into Biome. Today, most forensic analysts are aware of Biome and the SEGB/SEGBv2 file formats, and many commercial and open-source tools provide at least limited support for some of the available streams. However, after working on multiple real-world investigations, I realized that several fundamental questions remained surprisingly difficult to answer: When exactly did Apple introduce the SEGB format and the Biome framework? How did the storage locations evolve across different iOS versions? To what extent has Biome replaced KnowledgeC? How well do modern forensic tools actually support the available data? This article attempts to a...