This dashboard consolidates known knowledgeC.db, sms.db, CallHistory.storedata, healthdb_secure.sqlite, CoreRoutine.sqlite, Photos.sqlite, voicemail.db, powerlog data, and other data that can be found here.
When the phone was actively being used, by hour of day (local time, EST/UTC-5). Usage peaks in the early afternoon and late evening — consistent with a school-age user.
Total time each app spent in the foreground (actively on screen). The app mix — Snapchat, Instagram, Musical.ly, Candy Crush, a school portal (Skyward) Houseparty — is consistent with a teenager's phone circa early 2017.
Health data (steps, distance) from the accelerometer and GPS fixes from CoreRoutine.sqlite. The phone recorded significant walking activity between 10:55 AM and 2:32 PM, with GPS coordinates showing southwestward movement.
Research from the Forensic Science Institute in The Hague demonstrates that distance can be off by 30-40% either way, and the type of motion greatly impacts logging. Vigorous motion gets credited with extra steps/distance, while slow/casual walking may not be logged at all. The phone does NOT log movement if traveling in a vehicle (distinguishes driving from walking).
The 8-month delay between initial logical extraction (Feb. 15, 2017) and full file system extraction (Oct. 11, 2017) caused critical data loss. The "current power log" file—which would have shown exactly when the phone powered off on Feb. 13—was lost due to this delay and multiple power cycles.
"Every time you turn off a phone and then turn it back on, you're losing information just because of that action of shutting it off, you're losing some of the temporary files. But then, as the phone ages, files get older and some files will start to drop off at 28, 30 days old."
Battery percentage from knowledgeC over the course of Feb 13. The phone was unplugged at 1:48 PM at 27%, entered Low Power Mode at 10:54 AM (20%), and reached 4% by 2:41 PM. One brief charging session around 1:25 PM brought it from 4% to 28%.
Battery percentage over time for the two periods with dense data. Charging events (plugged in) are shown in green. The February data looks normal. October 11 is where it gets strange.
iOS tracks when audio output routes are active — this covers phone calls, speaker activation, and media playback. Three audio sessions were recorded on February 13.
The Feb. 15 extraction was only a "logical" extraction—basic user data like texts and photos. Cecil requested but did not obtain the "full file system" extraction until Oct. 11, 2017. This 8-month delay caused permanent loss of the current power log and other temporary system files that would have definitively shown when the phone powered off.
The knowledgeC database definitively shows wired headphones or an aux cable was inserted at 5:45:24 PM, milliseconds after an incoming call. When asked if this could happen without human interaction, Eldridge testified: "I cannot think of any explanation that does not involve humans." This action silenced all audio from the device.
Apple Health data shows no movement after 2:32 PM. Yet at 5:44 PM, the phone lost all cell service for nearly 11 hours. Eldridge could not find evidence on the device explaining this: "I could find no evidence on the phone to suggest what happened, so I can only conclude something external to the phone changed." Possible explanations: phone moved, signal blocked, or metal obstruction.
Multiple calls, iMessages, and FaceTime entries in Cecil's timeline show timestamps between 5:44 PM Feb. 13 and 4:33 AM Feb. 14. However, forensic analysis of actual device logs proves these were NOT delivered to the phone at those times—they were timestamped by Apple's servers when sent, but not received until service resumed at 4:33 AM.
Every database artifact examined for inconsistencies. Findings from cross-referencing all artifact sources. Includes anomalies from the knowledgeC.db analysis plus new observations from the full forensic timeline.
knowledgeC.db is a Core Data–backed SQLite database maintained by Apple's "Knowledge" system daemon on iOS and macOS. It silently records device usage events — which app is in the foreground, screen on/off state, battery level, charging status, lock state, audio routing, Siri usage, and media playback. The data is stored with Apple Core Data timestamps (seconds since January 1, 2001 00:00:00 UTC). This database is commonly extracted during forensic examinations of Apple devices and is a standard artifact in mobile forensics toolkits. All times in this analysis have been converted to local time (UTC-5 / Eastern Standard Time) unless otherwise noted.