Device Locked State
Overview
Section titled “Overview”Evidence: Device Locked State
Description: Collect Device Locked State
Category: System
Platform: macos
Short Name: devlock
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC device locked stream records when the device screen was locked or unlocked over time, building a timeline of physical presence at the machine.
Data Collected
Section titled “Data Collected”This collector gathers structured data about device lock and unlock state and timing. Results are recorded in device_locked.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records device lock state events into device_locked.
Forensic Value
Section titled “Forensic Value”This evidence shows when a user was physically present and interacting with the device, corroborating or contradicting other activity during an incident window.