Biome Activity Streams (segb files)

Location

Description

Binary segmented protobuf files that replaced portions of the knowledgeC.db system starting in iOS 16. Biome streams record granular user activity data across multiple stream types including app intents, app usage, device backlight state, media playback, location activity, Safari browsing, and notification interactions. Each stream is stored as a separate segb file with protobuf-encoded event records.

Forensic Value

Biome streams provide higher-resolution activity tracking than knowledgeC.db with more granular event types and faster write frequencies. The segb format retains deleted records within the file structure, enabling recovery of activity data the user believed was purged. Individual stream types like app.usage and safari.history provide redundant evidence sources that can corroborate or supplement primary artifact databases. Biome data is particularly valuable on iOS 16 and later where some activity categories are no longer written to knowledgeC.db. Parsing requires specialized tools due to the proprietary segmented protobuf format.

Tools Required