User Activity
Screen Time
Overview
Screen Time (introduced in macOS 10.15 Catalina) tracks detailed application and website usage, providing per-app usage durations, notification counts, and device pickup information. The data is stored in SQLite databases and syncs across devices via iCloud.
This article is under development. Detailed Screen Time forensic analysis documentation is coming soon.
Key Forensic Areas
- Application usage: Per-app usage duration by hour/day
- Website usage: Safari and browser website visit durations
- Notification counts: Per-app notification delivery counts
- Category usage: Usage grouped by app category
- Device pickups: Device wake/pickup events
File Locations
| File | Path | Description |
|---|---|---|
| RMAdminStore | ~/Library/Application Support/Knowledge/RMAdminStore-Local.sqlite | Local Screen Time data |
| Cloud store | ~/Library/Application Support/Knowledge/RMAdminStore-Cloud.sqlite | iCloud-synced data |