Overview
The macOS Reminders application stores task data in SQLite databases within a versioned container structure. Reminders include task titles, notes, due dates, completion timestamps, priorities, locations, and list organisation. The data provides insight into the user's planned activities, deadlines, and task completion patterns.
Forensic Significance
| Evidence Type | Forensic Value |
|---|
| Task content | What the user planned to do |
| Due dates | Deadlines and scheduling |
| Completion timestamps | When tasks were marked done |
| Location-based reminders | Physical locations of interest |
| Priority levels | Urgency assessment |
| Notes | Additional context and details |
| List organisation | How the user categorises their tasks |
File Locations
| Artifact | Path | Format |
|---|
| Reminders database | ~/Library/Reminders/Container_v1/Stores/*.sqlite | SQLite (Core Data) |
| Legacy path | ~/Library/Calendars/Calendar Cache | SQLite (shared with Calendar) |
On older macOS versions, reminders were stored in the same Calendar Cache database as calendar events. Modern macOS versions use a separate Reminders container.
Database Schema
ZREMCDREMINDER (Core Data entity)
| Column | Type | Description |
|---|
Z_PK | INTEGER | Primary key |
ZTITLE1 | TEXT | Reminder title |
ZNOTES | TEXT | Reminder notes |
ZDUEDATE | REAL | Due date (Core Data timestamp) |
ZCOMPLETIONDATE | REAL | When marked complete (Core Data timestamp) |
ZCREATIONDATE | REAL | Creation timestamp |
ZMODIFIEDDATE | REAL | Last modification timestamp |
ZPRIORITY | INTEGER | Priority (0=none, 1=high, 5=medium, 9=low) |
ZCOMPLETED | INTEGER | Whether the reminder is complete (0/1) |
ZLIST | INTEGER | FK to list |
ZFLAGGED | INTEGER | Whether the reminder is flagged |
ZREMCDLIST (Reminder Lists)
| Column | Type | Description |
|---|
Z_PK | INTEGER | Primary key |
ZNAME1 | TEXT | List name |
ZCOLOR | INTEGER | List colour |
ZCREATIONDATE | REAL | List creation timestamp |
Key Fields for Analysis
SELECT
r.ZTITLE1 AS title,
r.ZNOTES AS notes,
datetime(r.ZDUEDATE + 978307200, 'unixepoch') AS due_date,
datetime(r.ZCOMPLETIONDATE + 978307200, 'unixepoch') AS completed_date,
datetime(r.ZCREATIONDATE + 978307200, 'unixepoch') AS created,
CASE r.ZPRIORITY
WHEN 1 THEN 'High'
WHEN 5 THEN 'Medium'
WHEN 9 THEN 'Low'
ELSE 'None'
END AS priority,
l.ZNAME1 AS list_name
FROM ZREMCDREMINDER r
LEFT JOIN ZREMCDLIST l ON r.ZLIST = l.Z_PK
ORDER BY r.ZCREATIONDATE DESC;
Timestamps
Reminders uses Core Data timestamps (seconds since 2001-01-01 00:00:00 UTC).
Analysis Notes
- Task completion patterns: The gap between creation and completion dates reveals how the user manages their workload.
- Location reminders: Some reminders include geofence triggers that reveal locations of interest.
- Overdue tasks: Reminders with past due dates that remain incomplete may indicate abandoned plans.
- Cross-device sync: Reminders sync via iCloud across all Apple devices. Data collected from a Mac may reflect tasks created on an iPhone or iPad.
| Tool | Support |
|---|
| macfor | Not yet implemented (planned) |
| sqlite3 | Manual database inspection |
References