Application Media Usage
Overview
Section titled “Overview”Evidence: Application Media Usage
Description: Collect Application Media Usage
Category: System
Platform: macos
Short Name: appmedia
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC media usage stream records per-application media playback and consumption, including the owning application, playback duration, and, where available, the media URL behind the playback.
Data Collected
Section titled “Data Collected”This collector gathers structured data about application media playback, including the application, media metadata, and timing. Results are recorded in app_media_usage.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records application media usage into app_media_usage.
Forensic Value
Section titled “Forensic Value”This evidence ties a user to media content consumed at specific times, helping reconstruct activity timelines and revealing applications and content in use during an incident window.