Device Battery Percentage
Overview
Section titled “Overview”Evidence: Device Battery Percentage
Description: Collect Device Battery Percentage
Category: System
Platform: macos
Short Name: devbat
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC battery percentage stream records the device battery charge level over time, producing a fine-grained power timeline alongside other activity streams.
Data Collected
Section titled “Data Collected”This collector gathers structured data about device battery charge level and timing. Results are recorded in device_battery.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records battery percentage events into device_battery.
Forensic Value
Section titled “Forensic Value”Battery level trends help establish whether the device was actively used or idle during an incident window and corroborate other timeline artifacts.