User Activity Artifacts

macOS tracks user activity through shell command history, recently accessed files, application usage databases (KnowledgeC and Biome), Screen Time, location services, and notification delivery. These artifacts reconstruct what a user did, when, and for how long.

Categories

• Shell History — Bash, Zsh, Fish command history
• KnowledgeC — Application usage, device activity, media playback
• Biome — Next-generation activity streams (protobuf format)
• Screen Time — Application usage limits and categories
• Recent Items — Recently opened apps, documents, servers
• Location Services — Location clients, cached positions, significant locations
• Notification Center — Application notification history and delivery