Apple’s internal Biome framework is rapidly emerging as one of the most valuable sources of forensic intelligence on iOS, with newly analyzed data revealing detailed records of Safari browsing activity, Wallet transactions.
Originally misunderstood due to its name, Biome is not مرتبط with biometrics but instead powers Apple’s predictive intelligence ecosystem, including Siri suggestions, personalization, and behavioral modeling.
As explained by Howard Oakley the framework is designed to anticipate user actions. For forensic investigators, this predictive layer translates into a high-fidelity log of user behavior.
Earlier research, including John Hyla’s work on AppIntent streams, first identified structured activity artifacts stored under /private/var/mobile/Library/Biome/streams/.
Geraldine Blay later expanded this understanding by identifying the SEGB file signature within notification-related streams a discovery later formalized through DFRWS.
The SEGB format, introduced in iOS 14, marked the beginning of Biome’s structured data storage.
By iOS 15 and iOS 16, Apple significantly expanded its scope, introducing additional repositories such as /private/var/db/biome/streams/, indicating a shift toward system-level intelligence aggregation.
This transition accelerated in iOS 17 with the introduction of SEGBv2, a revised format requiring updated parsing methodologies, as documented by Cellebrite.
Analysis of modern devices running iOS 17 through iOS 26 access shows a consistent architecture where Biome stores data across both user-level and system-level directories, with more than 300 individual stream folders observed on standard devices.
Apple Biome Data framework
Despite this scale, most commercial and open-source forensic tools currently parse only a small subset of available streams.
Recent multi-version forensic analysis confirms that Biome has quietly evolved into a primary behavioral data repository, gradually displacing the long-relied-upon KnowledgeC.db database.
Manual examination of full file system acquisitions across multiple devices revealed at least 84 streams containing actionable forensic artifacts.
These include high-value data categories such as Safari browsing activity, detailed location visit logs, Wallet transaction traces, application usage patterns, Siri interaction history, and notification remnants.
Particularly notable are streams like Location.Visit and Siri.Remembers.MessageHistory, which contain deeply contextual behavioral data that can reconstruct user timelines with high precision.
The findings also reinforce a broader industry shift. Comparative analysis with KnowledgeC.db, supported by prior research from Ian Whiffin, shows a sharp decline in active KnowledgeC streams starting in iOS 16, dropping from over 60 to approximately 20.
This strongly suggests that Apple has migrated much of its behavioral telemetry into Biome, consolidating intelligence into a more scalable and modular architecture.
Biome’s forensic relevance gained mainstream attention in April 2026 following reports that investigators were able to recover Signal message content from iOS notification artifacts, even after the app was removed.
Apple subsequently addressed the issue, citing improper data retention in notification logging and implementing stricter redaction controls.
Tooling is now racing to keep pace with Biome’s expansion. The LEAPP project recently integrated support for dozens of newly identified streams, significantly improving artifact visibility.
However, a substantial gap remains between available data and parsed outputs, highlighting ongoing challenges in forensic standardization.
Retention patterns within Biome also vary widely. While many streams adhere to a roughly 28-day lifecycle, others persist for months, increasing their evidentiary value in long-term investigations.
As Apple continues to expand on-device intelligence, Biome stands out as a critical forensic frontier.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
