Skip to content

Instantly share code, notes, and snippets.

@0xdevalias

0xdevalias/accessing-apple-screen-time-data.md

Last active January 29, 2025 10:35
Show Gist options
  • Save 0xdevalias/38cfc92278f85ae89a46f0c156208fd5 to your computer and use it in GitHub Desktop.
Save 0xdevalias/38cfc92278f85ae89a46f0c156208fd5 to your computer and use it in GitHub Desktop.
Download ZIP
Some notes on accessing / exporting Apple's Screen Time data
Raw
accessing-apple-screen-time-data.md

Accessing / Exporting Apple's Screen Time Data

Some notes on accessing / exporting Apple's Screen Time data

Table of Contents

knowledgeC.db SQLite CoreData Models / Tables

See also:

⇒ ./extract-coredata-model-hierarchy.py ~/Library/Application\ Support/Knowledge/knowledgeC.db
- 1: AdditionChangeSet (Table: ZADDITIONCHANGESET)
- 2: ContextualChangeRegistration (Table: ZCONTEXTUALCHANGEREGISTRATION)
- 3: ContextualKeyPath (Table: ZCONTEXTUALKEYPATH)
- 4: CustomMetadata (Table: ZCUSTOMMETADATA)
- 5: DeletionChangeSet (Table: ZDELETIONCHANGESET)
- 6: Histogram (Table: ZHISTOGRAM)
- 7: HistogramValue (Table: ZHISTOGRAMVALUE)
- 8: KeyValue (Table: ZKEYVALUE)
- 9: Object (Table: ZOBJECT)
  - 10: Category
  - 11: Event
  - 12: Identifier
  - 13: Quantity
- 14: Source (Table: ZSOURCE)
- 15: StructuredMetadata (Table: ZSTRUCTUREDMETADATA)
- 16: SyncPeer (Table: ZSYNCPEER)

My DeepDive

The following is a DeepDive answer I researched and put together for a StackExchange question:

While this isn't a full solution (yet), I just stumbled across an app (Timing) that claims it can import from the Screen Time data.

Skimming through the getting started steps, it basically seems like they're using 'share screen time data with other devices', and then reading from the local database/etc somewhere on macOS that stores it:

To set up the Screen Time importer, open the Timing integration preferences and add the Screen Time integration. You will be asked to complete three steps:

  1. Enable Screen Time in System Settings on your Mac and enable sharing Screen Time data across devices. This is required so that your mobile Screen Time data can be synced to your Mac.
  2. Enable Screen Time on your mobile devices and enable sharing Screen Time data across devices. This is required for your mobile device to record data that Timing can import.
  3. Finally, grant Timing the "Full Disk Access" permission in System Settings. This is required for Timing to read your Screen Time database.

Some further digging/research led me to this StackOverflow answer, which referred to a blog post by Sarah Edwards titled Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage, which dives into a bunch of the details about the location of the SQLite database, a number of the tables within it, and some queries for extracting data from them.

Based on that, we can see that the database containing the Screen Time data is located at:

~/Library/Application\ Support/Knowledge/knowledgeC.db

We can confirm that this is a SQLite database by using the file command:

⇒ file ~/Library/Application\ Support/Knowledge/knowledgeC.db

/Users/devalias/Library/Application Support/Knowledge/knowledgeC.db: SQLite 3.x database, last written using SQLite version 3039005, writer version 2, read version 2, file counter 18507, database pages 7624, 1st free page 106, free pages 137, cookie 0x5a, schema 4, largest root page 50, UTF-8, vacuum mode 1, version-valid-for 18507

I also collated the above, along with a few other notes/references about the Screen Time database on a GitHub gist for future reference:

Edit (31/12/2024): First, I would suggest checking if the official Apple API's allow you to access what you need these days:

If not.. read on:

We can extract the CoreData table names/entity types from the SQLite database using a script like this one I wrote (extract-coredata-model-hierarchy.py), based on this knowledge about how CoreData works with SQLite), which for knowledgeC.db on macOS 14.5 will give output like this:

⇒ ./extract-coredata-model-hierarchy.py ~/Library/Application\ Support/Knowledge/knowledgeC.db

- 1: AdditionChangeSet (Table: ZADDITIONCHANGESET)
- 2: ContextualChangeRegistration (Table: ZCONTEXTUALCHANGEREGISTRATION)
- 3: ContextualKeyPath (Table: ZCONTEXTUALKEYPATH)
- 4: CustomMetadata (Table: ZCUSTOMMETADATA)
- 5: DeletionChangeSet (Table: ZDELETIONCHANGESET)
- 6: Histogram (Table: ZHISTOGRAM)
- 7: HistogramValue (Table: ZHISTOGRAMVALUE)
- 8: KeyValue (Table: ZKEYVALUE)
- 9: Object (Table: ZOBJECT)
  - 10: Category
  - 11: Event
  - 12: Identifier
  - 13: Quantity
- 14: Source (Table: ZSOURCE)
- 15: StructuredMetadata (Table: ZSTRUCTUREDMETADATA)
- 16: SyncPeer (Table: ZSYNCPEER)

Following along from Sarah Edwards' (@iamevltwin) 'Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage (2018)' blog post:

The database has many tables which have many columns. This article will only go over three of these that I have found to be particularly interesting. I encourage you to look at your own data to discover other items of investigative value. Timestamps in this database use the Mac Epoch time (01/01/2001 00:00:00 UTC).

  • ZOBJECT – Contains potentially thousands of usage entries for approximately 4 weeks. I will use this table as my primary table of analysis and add on other tables as needed throughout this article. Other tables that ZOBJECT entries may reference are located in these tables:
  • ZSOURCE – Source of the ZOBJECT entries
  • ZSTRUCTUREDMETADATA – Additional metadata associated with ZOBJECT entries

Taking a look at ZOBJECT, you’ll see that entries appear to have a “type” associated in the ZSTREAMNAME column. Using the following tiny SQLite query, I can see what “types” of entries I’m dealing with.

SELECT
DISTINCT ZOBJECT.ZSTREAMNAME
FROM ZOBJECT
ORDER BY ZSTREAMNAME

The output of this on the system context knowledgeC.db database on macOS shows the following “types”:

  • "/activity/level"
  • "/app/activity"
  • "/app/inFocus"
  • "/app/intents"
  • "/device/isPluggedIn"
  • "/display/isBacklit"
  • "/safari/history"

Let’s start with just the “/app/inFocus”. This “type” is available for macOS and iOS and will show us what application is being used at a given time.

Using another stream “type” - “/app/activity”, I can add more context to what is happening on the device.

Running that query on my system in macOS 14.5:

⇒ sqlite3 -readonly -json /Users/devalias/Library/Application\ Support/Knowledge/knowledgeC.db "SELECT
DISTINCT ZOBJECT.ZSTREAMNAME
FROM ZOBJECT
ORDER BY ZSTREAMNAME;"

Gives me the following output (UUIDs sanitised in case they are sensitive):

[{"ZSTREAMNAME":"/app/intents"},
{"ZSTREAMNAME":"/app/mediaUsage"},
{"ZSTREAMNAME":"/app/usage"},
{"ZSTREAMNAME":"/app/webUsage"},
{"ZSTREAMNAME":"/bluetooth/isConnected"},
{"ZSTREAMNAME":"/device/isLocked"},
{"ZSTREAMNAME":"/discoverability/signals"},
{"ZSTREAMNAME":"/display/isBacklit"},
{"ZSTREAMNAME":"/knowledge-sync-addition-window/99695702-111A-111A-AA1A-A11AA111AA05"},
{"ZSTREAMNAME":"/knowledge-sync-addition-window/A906F582-1111-1A11-A111-11A1A11A1AA1"},
{"ZSTREAMNAME":"/knowledge-sync-addition-window/E18C9519-11AA-1A11-AA1A-AA111A111A11"},
{"ZSTREAMNAME":"/knowledge-sync-addition-window/E304C6F5-11AA-1A1A-A111-AA1A11A11111"},
{"ZSTREAMNAME":"/knowledge-sync-deletion-bookmark/99695702-111A-111A-AA1A-A11AA111AA11"},
{"ZSTREAMNAME":"/knowledge-sync-deletion-bookmark/A906F582-1111-1A11-A111-11A1A11A1AA1"},
{"ZSTREAMNAME":"/knowledge-sync-deletion-bookmark/E18C9519-11AA-1A11-AA1A-AA111A111A11"},
{"ZSTREAMNAME":"/knowledge-sync-deletion-bookmark/E304C6F5-11AA-1A1A-A111-AA1A11A11111"},
{"ZSTREAMNAME":"/media/nowPlaying"},
{"ZSTREAMNAME":"/notification/usage"},
{"ZSTREAMNAME":"/portrait/entity"},
{"ZSTREAMNAME":"/portrait/topic"}]

While I haven't dived deeper into these differences yet, we can see that some of the types mentioned in the older article are missing, eg.

  • "/activity/level"
  • "/app/activity"
  • "/app/inFocus"
  • "/app/intents"
  • "/safari/history"

But we also have some new ones that sound like they could be relevant, eg.

  • "/app/mediaUsage"
  • "/app/usage"
  • "/app/webUsage"

We can query the database to see what kind of data exists in those entries with a command like this:

sqlite3 -readonly -json "/Users/devalias/Library/Application Support/Knowledge/knowledgeC.db" "
SELECT *
FROM ZOBJECT
WHERE ZOBJECT.ZSTREAMNAME IN ('/app/mediaUsage', '/app/usage', '/app/webUsage')
ORDER BY ZCREATIONDATE;
"

Which will give some entries like this (heavily cut down to give 1 example of each):

"/app/usage":

{
    "Z_PK": 934545,
    "Z_ENT": 11,
    "Z_OPT": 1,
    "ZUUIDHASH": -1111111111111111111,
    "ZEVENT": null,
    "ZSOURCE": 626664,
    "ZCATEGORYTYPE": null,
    "ZINTEGERVALUE": null,
    "ZCOMPATIBILITYVERSION": 0,
    "ZENDDAYOFWEEK": 3,
    "ZENDSECONDOFDAY": 85129,
    "ZHASCUSTOMMETADATA": 0,
    "ZHASSTRUCTUREDMETADATA": 1,
    "ZSECONDSFROMGMT": 39600,
    "ZSHOULDSYNC": 0,
    "ZSTARTDAYOFWEEK": 3,
    "ZSTARTSECONDOFDAY": 85116,
    "ZVALUECLASS": 1,
    "ZVALUEINTEGER": -1679949566117557781,
    "ZVALUETYPECODE": 6584185901589580638,
    "ZSTRUCTUREDMETADATA": 151742,
    "ZVALUE": null,
    "Z9_VALUE": null,
    "ZIDENTIFIERTYPE": null,
    "ZQUANTITYTYPE": null,
    "ZCREATIONDATE": 754875529.6133389472,
    "ZLOCALCREATIONDATE": 755392153.7813190222,
    "ZCONFIDENCE": 1.0,
    "ZENDDATE": 754875529,
    "ZSTARTDATE": 754875516,
    "ZVALUEDOUBLE": 16766794507591993340.0,
    "ZDOUBLEVALUE": null,
    "ZUUID": "3B8C4FD9-11A1-111A-1A11-1A1A1A11111A",
    "ZSTREAMNAME": "/app/usage",
    "ZVALUESTRING": "com.apple.calculator",
    "ZSTRING": null,
    "ZMETADATA": null
}

"/app/webUsage":

{
    "Z_PK": 936478,
    "Z_ENT": 11,
    "Z_OPT": 1,
    "ZUUIDHASH": 1111111111111111111,
    "ZEVENT": null,
    "ZSOURCE": null,
    "ZCATEGORYTYPE": null,
    "ZINTEGERVALUE": null,
    "ZCOMPATIBILITYVERSION": 0,
    "ZENDDAYOFWEEK": 6,
    "ZENDSECONDOFDAY": 84189,
    "ZHASCUSTOMMETADATA": 0,
    "ZHASSTRUCTUREDMETADATA": 1,
    "ZSECONDSFROMGMT": 39600,
    "ZSHOULDSYNC": 0,
    "ZSTARTDAYOFWEEK": 6,
    "ZSTARTSECONDOFDAY": 84181,
    "ZVALUECLASS": 1,
    "ZVALUEINTEGER": 2939589157913874707,
    "ZVALUETYPECODE": 6584185901589580638,
    "ZSTRUCTUREDMETADATA": 550882,
    "ZVALUE": null,
    "Z9_VALUE": null,
    "ZIDENTIFIERTYPE": null,
    "ZQUANTITYTYPE": null,
    "ZCREATIONDATE": 755738589.8895909787,
    "ZLOCALCREATIONDATE": 755738589.8895909787,
    "ZCONFIDENCE": 1.0,
    "ZENDDATE": 755738589,
    "ZSTARTDATE": 755738581,
    "ZVALUEDOUBLE": 2939589157913874944.0,
    "ZDOUBLEVALUE": null,
    "ZUUID": "6FCD28A0-1A11-11AA-1A1A-111A111A111A",
    "ZSTREAMNAME": "/app/webUsage",
    "ZVALUESTRING": "com.apple.Safari",
    "ZSTRING": null,
    "ZMETADATA": null
}

"/app/mediaUsage":

{
    "Z_PK": 934908,
    "Z_ENT": 11,
    "Z_OPT": 1,
    "ZUUIDHASH": -1111111111111111111,
    "ZEVENT": null,
    "ZSOURCE": null,
    "ZCATEGORYTYPE": null,
    "ZINTEGERVALUE": null,
    "ZCOMPATIBILITYVERSION": 0,
    "ZENDDAYOFWEEK": 2,
    "ZENDSECONDOFDAY": 3753,
    "ZHASCUSTOMMETADATA": 0,
    "ZHASSTRUCTUREDMETADATA": 1,
    "ZSECONDSFROMGMT": 39600,
    "ZSHOULDSYNC": 0,
    "ZSTARTDAYOFWEEK": 2,
    "ZSTARTSECONDOFDAY": 3750,
    "ZVALUECLASS": 1,
    "ZVALUEINTEGER": -1967530580424620332,
    "ZVALUETYPECODE": 6584185901589580638,
    "ZSTRUCTUREDMETADATA": 557157,
    "ZVALUE": null,
    "Z9_VALUE": null,
    "ZIDENTIFIERTYPE": null,
    "ZQUANTITYTYPE": null,
    "ZCREATIONDATE": 755398953.4697099925,
    "ZLOCALCREATIONDATE": 755398953.4697099925,
    "ZCONFIDENCE": 1.0,
    "ZENDDATE": 755398953,
    "ZSTARTDATE": 755398950,
    "ZVALUEDOUBLE": 16479213493284931580.0,
    "ZDOUBLEVALUE": null,
    "ZUUID": "6BF4DD28-1111-1AAA-11A1-1AAAAA11A1A1",
    "ZSTREAMNAME": "/app/mediaUsage",
    "ZVALUESTRING": "com.apple.quicklook.QuickLookUIService",
    "ZSTRING": null,
    "ZMETADATA": null
}

Without looking too much deeper, that would seem to imply to me that the app usage data is likely still within knowledgeC.db, but the relevant ZSTREAMNAME values have changed since the blog post was first written in 2018.

I also noticed that Sarah Edwards (@iamevltwin) has a new blog post from October 6 2024:

I’ve uploaded my presentation that I gave at the lovely Sikkerhetsfestivalen 2024 in Lillehammer, Norway.

This presentation goes through some pattern-of-life (APOLLO-ish) investigative scenarios.

In the presentation slides PDF:

  • there is a slide about extracting 'now playing' data (including usage duration) from knowledgeC.db
  • there is a slide about extracting application usage data from knowledgeC.db
  • there are slides about "Syncing Biomes" which includes: "Apps In Focus", "Chat Metadata", "Now Playing"
    • ~/Library/Biome
    • /private/var/mobile/Library/Biome

This gives some other potential areas that we might be able to find this sort of data in modern versions of macOS / iOS.

There also may be a bunch more interesting snippets of info in Sarah's blogs tagged APOLLO:

Looking deeper into the APOLLO GitHub repository, we find relevant queries for /app/usage, /app/webUsage, and /app/mediaUsage:

Using the query for /app/usage like follows:

sqlite3 -readonly -json "/Users/devalias/Library/Application Support/Knowledge/knowledgeC.db" "
SELECT
  DATETIME(ZOBJECT.ZSTARTDATE + 978307200, 'UNIXEPOCH') AS 'START',
  DATETIME(ZOBJECT.ZENDDATE + 978307200, 'UNIXEPOCH') AS 'END',
  ZOBJECT.ZVALUESTRING AS 'BUNDLE ID',
  (ZOBJECT.ZENDDATE - ZOBJECT.ZSTARTDATE) AS 'USAGE IN SECONDS',
  (ZOBJECT.ZENDDATE - ZOBJECT.ZSTARTDATE) / 60.00 AS 'USAGE IN MINUTES',
  ZSOURCE.ZDEVICEID AS 'DEVICE ID (HARDWARE UUID)',
  ZCUSTOMMETADATA.ZNAME AS 'NAME',
  ZCUSTOMMETADATA.ZDOUBLEVALUE AS 'VALUE',
  CASE ZOBJECT.ZSTARTDAYOFWEEK
    WHEN '1' THEN 'Sunday'
    WHEN '2' THEN 'Monday'
    WHEN '3' THEN 'Tuesday'
    WHEN '4' THEN 'Wednesday'
    WHEN '5' THEN 'Thursday'
    WHEN '6' THEN 'Friday'
    WHEN '7' THEN 'Saturday'
  END AS 'DAY OF WEEK',
  ZOBJECT.ZSECONDSFROMGMT / 3600 AS 'GMT OFFSET',
  DATETIME(ZOBJECT.ZCREATIONDATE + 978307200, 'UNIXEPOCH') AS 'ENTRY CREATION',
  ZOBJECT.ZUUID AS 'UUID',
  ZSTRUCTUREDMETADATA.ZMETADATAHASH,
  ZOBJECT.Z_PK AS 'ZOBJECT TABLE ID'
FROM ZOBJECT
  LEFT JOIN ZSTRUCTUREDMETADATA
    ON ZOBJECT.ZSTRUCTUREDMETADATA = ZSTRUCTUREDMETADATA.Z_PK
  LEFT JOIN ZSOURCE
    ON ZOBJECT.ZSOURCE = ZSOURCE.Z_PK
  LEFT JOIN Z_4EVENT
    ON ZOBJECT.Z_PK = Z_4EVENT.Z_11EVENT
  LEFT JOIN ZCUSTOMMETADATA
    ON Z_4EVENT.Z_4CUSTOMMETADATA = ZCUSTOMMETADATA.Z_PK
WHERE ZSTREAMNAME = '/app/usage';
"

We get data like this (truncated to a single row for brevity):

{
    "START": "2024-12-28 00:40:35",
    "END": "2024-12-28 00:44:06",
    "BUNDLE ID": "com.sublimetext.4",
    "USAGE IN SECONDS": 211,
    "USAGE IN MINUTES": 3.516666666666666607,
    "DEVICE ID (HARDWARE UUID)": "99695702-111A-111A-AA1A-A11AA111AA11",
    "NAME": null,
    "VALUE": null,
    "DAY OF WEEK": "Saturday",
    "GMT OFFSET": 11,
    "ENTRY CREATION": "2024-12-28 00:44:06",
    "UUID": "F56874B9-11AA-11A1-AA1A-11AA1A111111",
    "ZMETADATAHASH": "11111111111111111111111111111111",
    "ZOBJECT TABLE ID": 942001
}

Which confirms that it's still very much possible to extract the ScreenTime data on macOS 14.5 (and likely later).

Searching GitHub seems to show a number of other tools that look like they already use this feature as well:

Unsorted

  • From ChatGPT (Ref):
    • Note: This seems to be wrong, at least on macOS Ventura.. not sure if it was ever correct.

    • On macOS, the Screen Time data is stored in a SQLite database located at:

    • ~/Library/Application Support/ScreenTimeAgent/Database/CoreDuetData.db

    • To access this database, you can use a SQLite browser tool, such as DB Browser for SQLite, which is a free, open-source tool that can be downloaded from their website at https://sqlitebrowser.org/.

    • Once you have installed DB Browser for SQLite, you can open the CoreDuetData.db file and browse the tables to view the Screen Time data. Note that the data is stored in a compressed format, so you may need to use a SQLite extension or command-line tool to decompress the data for viewing.

  • https://stackoverflow.com/questions/66935741/how-to-get-screen-time-data-on-macos/70627001#70627001

    • The data screenTime is stored in /private/var/db/CoreDuet/Knowledge /Users/wgnb/Library/Application Support/Knowledge

      • ~/Library/Application\ Support/Knowledge
      • ~/Library/Application\ Support/Knowledge/knowledgeC.db

    • read Sarah blog for details

      • https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage

        • The knowledgeC.db database can be found on macOS and iOS devices. On Mac systems there will be a system context database located in the /private/var/db/CoreDuet/Knowledge directory, while a user context database is located in the user’s ~/Library/Application Support/Knowledge/ directory. *Update 08/7/18: The data in this article is specific to macOS 10.13 and iOS 11. Other versions may contain the same data but the schemas/contents may be slightly different. A note about iOS 10 database is at the end of this article.

        • On iOS there is only one main knowledgeC.db database located in /private/var/mobile/Library/CoreDuet/Knowledge/ that appears to merge the contents of the user and system context databases found on macOS.

        • The database has many tables which have many columns. This article will only go over three of these that I have found to be particularly interesting.

        • ZOBJECT – Contains potentially thousands of usage entries for approximately 4 weeks.

        • ZSOURCE – Source of the ZOBJECT entries

        • ZSTRUCTUREDMETADATA – Additional metadata associated with ZOBJECT entries

  • https://stackoverflow.com/questions/66935741/how-to-get-screen-time-data-on-macos/66946521#66946521
  • https://apple.stackexchange.com/questions/346091/is-there-a-way-to-download-screen-time-data-from-iphone-or-other-apple-devices
  • https://www.r-bloggers.com/2019/10/spelunking-macos-screentime-app-usage-with-r/
  • https://felixkohlhas.com/projects/screentime/

    • Exporting and Analyzing iOS Screen Time Data using Python and InfluxDB Felix Kohlhas • 2023-06-10

    • https://github.com/FelixKohlhas/ScreenTime2CSV

      • ScreenTime2CSV ScreenTime2CSV is a Python script to query Screen Time data from the macOS knowledgeC.db database and export it to CSV format.

  • https://github.com/AndreasInk/FocusPandas

    • FocusPandas: HealthKit and Screen Time Data Analyzer Analyze your digital habits, health metrics, and productivity patterns with this data-driven dashboard.

  • How can I list the open file descriptors for a process running on macOS? (ChatGPT Ref)
    • Get the PID: pgrep ScreenTimeAgent
    • List open file descriptors: lsof -p <pid>
    • One liner: ST_PID=$(pgrep ScreenTimeAgent); lsof -p $ST_PID 
      • ⇒ ST_PID=$(pgrep ScreenTimeAgent); lsof -p $ST_PID
COMMAND   PID     USER   FD      TYPE DEVICE  SIZE/OFF                NODE NAME
ScreenTim 826 devalias  cwd       DIR    1,4       384               40725 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data
ScreenTim 826 devalias  txt       REG    1,4   2858656 1152921500312301519 /System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
ScreenTim 826 devalias  txt       REG    1,4     52300           119749843 /Library/Preferences/Logging/.plist-cache.SaRrvI6F
ScreenTim 826 devalias  txt       REG    1,4    281152 1152921500312437674 /usr/lib/libobjc-trampolines.dylib
ScreenTim 826 devalias  txt       REG    1,4     32768               41700 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-shm
ScreenTim 826 devalias  txt       REG    1,4       110 1152921500312100418 /System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings
ScreenTim 826 devalias  txt       REG    1,4    237664           107197209 /private/var/db/timezone/tz/2023c.1.0/icutz/icutz44l.dat
ScreenTim 826 devalias  txt       REG    1,4     32768               41754 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-shm
ScreenTim 826 devalias  txt       REG    1,4  30447056 1152921500312449382 /usr/share/icu/icudt70l.dat
ScreenTim 826 devalias  txt       REG    1,4    134457 1152921500312134360 /System/Library/Frameworks/CoreData.framework/Versions/A/Resources/CoreDataErrors.loctable
ScreenTim 826 devalias  txt       REG    1,4     32768               82945 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db-shm
ScreenTim 826 devalias  txt       REG    1,4    626688           104208182 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/C/com.apple.iconservices/store.index
ScreenTim 826 devalias  txt       REG    1,4    825440 1152921500312138426 /System/Library/Frameworks/Foundation.framework/Versions/C/Resources/FoundationErrors.loctable
ScreenTim 826 devalias  txt       REG    1,4    132070           121959101 /private/var/db/analyticsd/events.allowlist
ScreenTim 826 devalias    0r      CHR    3,2       0t0                 314 /dev/null
ScreenTim 826 devalias    1u      CHR    3,2       0t0                 314 /dev/null
ScreenTim 826 devalias    2u      CHR    3,2 0t7142668                 314 /dev/null
ScreenTim 826 devalias    3u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias    4u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal
ScreenTim 826 devalias    5u      REG    1,4     32768               41700 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-shm
ScreenTim 826 devalias    6u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias    7u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal
ScreenTim 826 devalias    8u      REG    1,4  13381632               41725 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite
ScreenTim 826 devalias    9u      REG    1,4    218392               41753 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-wal
ScreenTim 826 devalias   10u      REG    1,4     32768               41754 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-shm
ScreenTim 826 devalias   11u      REG    1,4  13381632               41725 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite
ScreenTim 826 devalias   12u      REG    1,4  13381632               41725 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite
ScreenTim 826 devalias   13u      REG    1,4    218392               41753 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-wal
ScreenTim 826 devalias   14u      REG    1,4    218392               41753 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-wal
ScreenTim 826 devalias   15u      REG    1,4  13381632               41725 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite
ScreenTim 826 devalias   16u      REG    1,4    218392               41753 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Cloud.sqlite-wal
ScreenTim 826 devalias   17u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias   18u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal
ScreenTim 826 devalias   19u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias   20u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal
ScreenTim 826 devalias   21   NPOLICY
ScreenTim 826 devalias   22u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias   23u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal
ScreenTim 826 devalias   24u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias   25u      REG    1,4     49152               82941 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db
ScreenTim 826 devalias   26u      REG    1,4  14741504               41682 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite
ScreenTim 826 devalias   27u      REG    1,4    778712               82944 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db-wal
ScreenTim 826 devalias   28u      REG    1,4     32768               82945 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db-shm
ScreenTim 826 devalias   29u      REG    1,4     49152               82941 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db
ScreenTim 826 devalias   30u      REG    1,4    778712               82944 /Users/devalias/Library/Containers/com.apple.ScreenTimeAgent/Data/Library/Caches/com.apple.ScreenTimeAgent/Cache.db-wal
ScreenTim 826 devalias   31u      REG    1,4   2550312               41699 /private/var/folders/j4/kxtq1cjs1l98xfqncjbsbx1c0000gn/0/com.apple.ScreenTimeAgent/Store/RMAdminStore-Local.sqlite-wal

See Also

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment