This guide explains how an iPhone's internal databases, such as Knowledge C and Biome, record device activity, and why expert interpretation is essential.
Guide · 18 pages · 25 min read · Published 2026-09-02
Solicitors and litigators facing disputes over device usage often need to establish whether an iPhone was actively used at a critical moment. iPhones maintain an automated internal diary of events in databases such as Knowledge C and Biome, recording app usage, screen and lock states, notifications, and system connections. Interpreting this digital evidence requires expert forensic analysis because the raw records are cryptic, prone to misinterpretation, and subject to automatic log rotation and data ageing out. Covering the full spectrum of device activity reconstruction, the overview explains how live databases, APFS snapshots, paired devices, and backups form a wider evidentiary map. It equips UK legal practitioners with CPR Part 35 expert report standards, chain of custody requirements, and practical drafting tools, including interrogatories for opponents and client questionnaires. By detailing technical limitations, red flags, and common pitfalls, it provides counsel and forensic providers with a precise framework to verify device timelines, draft formal instructions, and determine when specialist digital laboratory assistance is required to protect client interests.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
18 pages · 25 min read
An iPhone maintains a detailed diary of its use in internal databases, recording app usage, screen state, notifications, and connections.
Published by Computer Forensics Lab on 2026-09-02. Original material of the practice, free to read, cite and download. The authority behind this subject is Civil Procedure Rules Part 35, experts and assessors, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
IOSKNOWLEDGE & BIOME · A GUIDE FOR UK LAWYERS iOS Knowledge and Biome: The Device Activity Record The Phone's Own Diary of What Was Done, and Why It Must Be Read by an Expert COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DEVICE-ACTIVIT Y RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone keeps a diary 03 What the iOS activity databases record 04 Reconstructing the device-activity timeline 05 Why expert interpretation is essential 06 Log rotation, corroboration and honest limits 07 Deployment: proving what the device was doing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an iPhone keeps a fine-grained diary of its own use in internal databases such as Knowledge C and Biome, recording which apps were used and when, screen and lock state, notifications and connections, a powerful source for reconstructing user activity, but cryptic, specialist to interpret, and subject to ageing out.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone keeps a diary
§ 03 · WHATTHEYRECORD What the iOS activity databases record APP USAGE SCREEN / LOCK NOTIFICATIONS CONNECTIONS TIMELINE
§ 04 · THEACTIVITYTIMELINE Reconstructing the device-activity timeline
§ 05 · EXPERTINTERPRETATION Why expert interpretation is essential
§ 06 · ROTATIONANDHONESTLIMITS Log rotation, corroboration and honest limits
§ 07 · DEPLOYMENT Deployment: proving what the device was doing
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAC / PHONE LIVE ACTIVIT Y BACKUPS / APFS AGED-OUT / DATABASES ICLOUD SNAPSHOTS RECOVERABLE PAIRED OTHER IPAD DATA
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDIARYTHATSHOWEDTHEPHONEWASINUSE EXAMPLE2 · THECRYPTICFIELDTHATWASNEARLYMISREAD EXAMPLE3 · THEGAPTHATWASROTATION, ANDTHEBACKUPTHATFILLEDIT
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR AN AC TIVITY- DATABASE ANALYSIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic The activity-database checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What are Knowledge C and Biome? What can these databases show? Why do these need an expert to interpret? If there are no activity records for a period, does that prove nothing happened? How reliable is this evidence? How urgent is preserving the phone for this?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
10 pages · 14 min read
A complete guide to how Computer Forensics Lab handles electronic evidence for UK litigation, internal investigations and regulatory work.
72 pages · 156 min read
Guide 7 in the CFL Electronic Evidence Series, a legal and technical reference for practitioners in England and Wales who meet crypto assets in litigation, fraud investigations, insolvency, divorce and regulatory work.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
