Application In Focus
Overview
Section titled “Overview”Evidence: Application In Focus
Description: Collect Application In Focus
Category: System
Platform: macos
Short Name: appfocus
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC in-focus stream records which application held foreground focus and for how long. This is distinct from generic application usage and pinpoints the app the user was actively interacting with at a given moment.
Data Collected
Section titled “Data Collected”This collector gathers structured data about which application was in the foreground, including timing and duration. Results are recorded in app_in_focus.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records application in-focus events into app_in_focus.
Forensic Value
Section titled “Forensic Value”This evidence reconstructs precise user interaction timelines, revealing which app was front-most during an incident and aiding anomaly detection.