While helping some investigators out I realized that my some of my APOLLO knowledgeC modules needed a bit of updating. Naturally I thought it would be quick, but it turned into quite an extensive update. I’ve included lots of brand-new modules as well as updates to ones that I’ve had before.
Most of the updates to the older ones provided better backwards compatibility with older versions of macOS and iOS as well as adding additional contextual items to some of the queries from ZSTRUCTUREDMETADATA. Regression testing was performed on iOS 11, 12, and 13 and macOS 10.13, 10.14, and 10.15. Of course, please let me know if you run into a knowledgeC “stream” that I’ve not created a module for, or any issues that you might come across.
I’ve highlighted a few modules below using my iOS 13.5 device. However, they may also apply to macOS and older iOS versions as well – review the modules for more documentation.
New Modules:
-
knowledge_activity_level_feedback.txt
-
knowledge_airplay_prediction.txt
-
knowledge_calendar_event_title.txt
-
knowledge_charging_smart_topoff_checkpoint.txt
-
knowledge_dasd_battery_temperature.txt
-
knowledge_device_locked_imputed.txt
-
knowledge_discoverability_usage.txt
-
knowledge_event_tombstone.txt
-
knowledge_inferred_microlocation_visit.txt
-
knowledge_knowledge_sync_addition_window.txt
-
knowledge_photos_edit_all.txt
-
knowledge_photos_deletes_all.txt
-
knowledge_photos_deletes_recent.txt
-
knowledge_photos_engagement.txt
-
knowledge_photos_share_airdrop.txt
-
knowledge_photos_share_all.txt
-
knowledge_photos_share_extension.txt
-
knowledge_segment_monitor.txt
-
knowledge_siri_activites.txt
-
knowledge_siri_flow_activity.txt
-
knowledge_sync_addition_window.txt
-
knowledge_sync_deletion_bookmark.txt
-
knowledge_user_first_backlight_after_wakeup.txt
The knowledge_app_activity_passbook.txt module was added to conveniently look for Apple Wallet (com.apple.Passbook) activity. Shown below I’m switching between my Apple Cash card and my Apple Card (yes, I got one for “research”).
