Pro plugin

Pattern of Life

Collects macOS behavioral databases including KnowledgeC activity records, Biome SEGB stream data, Screen Time usage, InteractionC contact interactions, and DuetActivityScheduler scheduling records

system.patternoflifePromacOS 10.15+v1.0.0logsmetadata

Run this plugin

Trigger collection for Pattern of Life on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.patternoflife --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.patternoflife --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (7 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

logs

Artifact	Format	Path	Notes
KnowledgeC Activity Records knowledgec_activity	jsonl	`~/Library/Application Support/Knowledge/knowledgeC.db` +1 more `/private/var/db/CoreDuet/Knowledge/knowledgeC.db`	User and device activity records from KnowledgeC with stream types, timestamps, source context, and structured metadata.
Biome Stream Records biome_stream	jsonl	`~/Library/Biome/streams/` +1 more `/private/var/db/biome/streams/`	Behavioral data from Biome SEGB binary streams with decoded protobuf payloads. Covers 130+ stream types.
Screen Time Usage Records screentime_usage	jsonl	`~/Library/Application Support/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite` +1 more `~/Library/Application Support/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite`	Screen Time usage blocks with per-app and per-domain usage seconds, pickup counts, and session durations.
InteractionC Interaction Records interaction_record	jsonl	`/private/var/db/CoreDuet/People/interactionC.db`	Cross-application interaction records with direction, bundle ID, and AddressBook contact correlation.
InteractionC Contact Summaries interaction_contact	jsonl	`/private/var/db/CoreDuet/People/interactionC.db`	Contact summaries with first/last incoming and outgoing interaction dates.
DuetActivityScheduler Records dasd_activity	jsonl	`/private/var/db/DuetActivityScheduler/DuetActivitySchedulerData.db`	Background task scheduling records with bundle IDs, activity types, and scheduling timestamps.

storage

Artifact	Format	Path	Notes
Pattern of Life Raw Files patternoflife_raw_store	binary	`~/Library/Application Support/Knowledge/knowledgeC.db` +4 more `~/Library/Biome/streams/` `~/Library/Application Support/com.apple.ScreenTimeAgent/Store/RMAdminStore-.sqlite` `/private/var/db/CoreDuet/People/interactionC.db` `/private/var/db/DuetActivityScheduler/DuetActivitySchedulerData.db*`	Raw database files and Biome SEGB files for offline analysis. Opt-in only.