macOS SQLite database paths and schemas
Path inventory: 2026-01-21. Table inventories: 2026-06-10. macOS build was not recorded in the original inventory.
~ denotes the user's home directory. Paths and schemas vary by macOS version, account configuration, and library location. Listed columns are schema examples; their presence does not establish populated values or retention periods.
Knowledge
~/Library/Application Support/Knowledge/knowledgeC.db
| Table | Fields / contents |
|---|---|
ZOBJECT | Event stream name, value, creation date, start date, end date |
ZSOURCE | App bundle ID, device ID, source ID |
ZSYNCPEER | Device ID, device model |
ZSTRUCTUREDMETADATA | Fields for web domains, media titles, Bluetooth device names, location coordinates, and other event metadata |
Siri
~/Library/Group Containers/group.com.apple.siri.remembers/siriremembers.sqlite3
| Table | Fields |
|---|---|
apps | bundle_id |
intents | app_id, domain_id, verb_id, start_date, duration_seconds, handling_status |
entities | tokens, created_at, updated_at |
~/Library/Group Containers/group.com.apple.siri.remembers/siriremembers2.sqlite3
| Table | Fields |
|---|---|
entities | type, fields, fieldsTokens, createdAt, updatedAt |
Photos
~/Pictures/Photos Library.photoslibrary/database/Photos.sqlite
| Table | Fields / contents |
|---|---|
ZASSET | Creation date, filename, latitude, longitude, duration |
ZDETECTEDFACE | Detected faces and associations with assets and people |
ZPERSON | Person records, including ZFULLNAME |
ZCHARACTERRECOGNITIONATTRIBUTES | Character-recognition data, including ZCHARACTERRECOGNITIONDATA |
The path above uses the default Photos library name and location.
Call history
~/Library/Application Support/CallHistoryDB/CallHistory.storedata
| Table | Fields / contents |
|---|---|
ZCALLRECORD | Call date, duration, type, direction, answered status, participant information, service provider |
ZHANDLE | Participant handles |
Messages
~/Library/Messages/chat.db
| Table | Fields / contents |
|---|---|
message | text, attributedBody, date, date_read, is_read, is_from_me, service |
chat | Conversation records |
handle | Contact identifiers and service |
attachment | Attachment metadata, including filenames |
Safari
~/Library/Safari/History.db
| Table | Fields / contents |
|---|---|
history_items | URLs and visit counters |
history_visits | Visit times, page titles, redirect source and destination |
history_tombstones | History deletion / clear records |
Notes
~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite
| Table | Fields / contents |
|---|---|
ZICCLOUDSYNCINGOBJECT | Note, folder, attachment, account, and sharing fields |
ZICNOTEDATA | Note body data, including ZDATA, and encryption-related fields |
ZICNOTEPARTICIPANT | Note participant identifiers |
Locked notes use additional encryption. Apple: secure features in the Notes app.
~/Library/Mail/V10/MailData/Envelope Index
| Table | Fields / contents |
|---|---|
messages | Sender, subject and summary references, sent/received dates, mailbox membership, flags |
addresses, recipients | Correspondent addresses and recipient relationships |
subjects | Subject text |
generated_summaries | Summary data and status |
V10 is the directory recorded in the source inventory.
TCC permissions
~/Library/Application Support/com.apple.TCC/TCC.db
/Library/Application Support/com.apple.TCC/TCC.db
The schema inventory covers the copied user database. The system database path is listed in the original path inventory.
| Table | Fields |
|---|---|
access | client, service, auth_value, auth_reason, last_modified |
These fields describe authorization state, not individual uses of a permission.
Additional SQLite databases
| Database | Path | Documented tables / fields |
|---|---|---|
| Reminders | ~/Library/Group Containers/group.com.apple.reminders/Container_v1/Stores/Data-local.sqlite | ZREMCDREMINDER: titles, notes, due dates, priorities, completion state and dates |
| Voice Memos | ~/Library/Group Containers/group.com.apple.VoiceMemos.shared/Recordings/CloudRecordings.db | ZCLOUDRECORDING, ZRECORDING: dates, durations, labels, recording paths; playback state in ZCLOUDRECORDING |
| HomeKit events | ~/Library/HomeKit/homeeventsd/homeevents.sqlite | ZPENDINGUPLOADEVENT: event type, date, home identifier, tags, data payload |
| iCloud Drive | ~/Library/Application Support/CloudDocs/session/db/client.db | client_items, client_downloads: filenames, parent relationships, timestamps, sync and transfer state |
Paths without a documented SQLite schema
CoreDuet
/var/db/CoreDuet/People/interactionC.db
Listed as "People interactions" in the original inventory. No corresponding table inventory was available in the reviewed documentation.
Find My
~/Library/Group Containers/group.com.apple.icloud.searchpartyuseragent/Library/Storage/CloudStorage.db
~/Library/Group Containers/group.com.apple.findmy.findmylocateagent/Library/Application Support/LocalStorage.db
~/Library/Group Containers/group.com.apple.findmy.findmylocateagent/Library/Application Support/CloudStorage.db
The corresponding files in the research corpus lacked a SQLite header and returned file is not a database during SQLite checks. Their format and contents remain unresolved.
Access and storage notes
- Protected locations require the applicable macOS privacy permissions, which can include Full Disk Access. Sandbox and filesystem restrictions also affect access. Apple: controlling app access to files, Apple: App Sandbox file access.
- Apps already granted Full Disk Access can access protected app containers without an additional container-access prompt. Apple: What's new in privacy, WWDC23.
- A SQLite write-ahead log can contain committed changes that have not yet been written to the main database file. SQLite: write-ahead logging.
点赞
收藏
点踩
分享评论
?
参与讨论