Apple’s Biome framework has become a major source of digital evidence on modern iPhones, and new iLEAPP parsers now help investigators examine 84 previously underused streams.
The update significantly expands access to behavioral, contextual, and predictive data stored across iOS file-system acquisitions.
Despite its name, Biome is not a biometric system. It is an Apple framework used to support Siri intelligence, recommendations, personalization, predictions, and proactive user experiences, as researcher Howard Oakley previously explained in his analysis of the feature.
That purpose makes Biome highly relevant to forensic work. Data used by iOS to predict user behavior can preserve traces of application use, locations, notifications, device activity, media playback, and other contextual events.
Early public research appeared in 2022, when John Hyla examined AppIntent records in Biome stream files. His research showed that iOS stored meaningful activity data in files under /private/var/mobile/Library/Biome/streams/public/.
iLEAPP Decodes Apple Biome Streams
Later that year, Geraldine Blay identified the same underlying format in notification artifacts stored in the DuetExpertCenter directory.
Her research identified the SEGB file signature, which became the commonly used name for the format among forensic analysts. Her notification analysis also showed that Biome-related data extended far beyond application intents.
Historical acquisition reviews suggest that SEGB files first appeared consistently in iOS 14.
iOS 15 expanded the framework with public, restricted, and notification-related streams, while iOS 16 added a system-level repository at /private/var/db/biome/streams/.
Apple introduced the newer SEGBv2 format with iOS 17, requiring parser updates across the forensic industry. Cellebrite documented key structural changes between the original SEGB format and SEGBv2, helping researchers adapt their decoding methods.
The growth of Biome also appears linked to the declining value of KnowledgeC.db.
KnowledgeC was once one of iOS’s richest behavioral databases, but evidence from historical datasets indicates that many of its streams diminished from iOS 16 onward as Biome expanded.
Some records remain duplicated, but many behavioral artifacts now appear to be stored primarily in Biome.
A review of full file-system acquisitions from iOS 18 and iOS 26 devices found more than 300 stream folders in the user-level Biome repository, plus roughly 40 system-level streams.
Yet most current forensic tools reportedly parse only a small fraction of the available data, digital-forensics said. The findings were shared with Alexis Brignoni, lead of the open-source LEAPP project.
New parsers were then developed and integrated into iLEAPP, enabling investigators to extract a far wider range of Biome evidence from full file-system iPhone acquisitions.
iLEAPP’s project repository describes the tool as an iOS and iPadOS logs, events, and plist parser that produces multiple forensic output formats.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
