Researchers Uncover 84 Hidden iOS Data Streams in Biome Framework
Security researchers have identified 84 previously undocumented data streams within Apple's iOS Biome framework, capable of retaining detailed user activity and offering significant forensic value.
Researchers from Zena Forensics have identified a significant expansion of data retention capabilities within Apple's Biome framework on iOS, uncovering 84 distinct data streams that can preserve detailed records of user activity. These streams, which include app usage, location data, messages, connectivity logs, and device state changes, are designed to support personalized features and AI-driven insights but also present a rich source of forensic evidence.
The findings highlight a notable shift in how user data is managed on iOS devices. Historically, much of this behavioral data was consolidated in the KnowledgeC database. However, Apple has increasingly integrated these records into the Biome framework, which was introduced in iOS 14 and has seen its scope expand significantly through subsequent versions, particularly with the introduction of the SEGBv2 storage format in iOS 17. This evolution positions Biome as a central repository for contextual and behavioral information, enhancing Apple's ability to deliver personalized user experiences.
Of the 84 identified streams, 16 were found in the system-level Biome repository, while an additional 68 reside in the user-level repository. The data contained within these streams is diverse, encompassing evidence related to application usage and installations, Safari browsing history, visited locations, Wallet transactions, CarPlay interactions, Screen Time usage, wireless network connections, power events, Siri queries, keyboard input, media playback, and activity related to Apple Intelligence features. The level of detail varies depending on the iOS version, specific device activity, user settings, and the method of data acquisition.
A critical implication for digital forensics is the potential for Biome streams to retain data for longer periods than previously assumed. While many streams appear to adhere to a roughly four-week retention cycle, others have been observed to hold information for several months. This extended retention period significantly increases the value of Biome data for investigators tasked with reconstructing events from older timelines, especially when correlated with other digital artifacts like application logs and network data.
Two streams of particular interest to investigators are Siri.Remembers.MessageHistory, which may offer valuable context for message-related activities, and Location.Visit, which can provide detailed information about places a user has been. However, researchers caution that any conclusions drawn from parsed Biome data must be rigorously validated against other corroborating evidence to ensure accuracy and defensibility in investigations.
The research also underscores a gap in current digital forensic tooling. Many existing tools are capable of parsing only a fraction of the available Biome streams, often interpreting between 10 to 20 out of potentially over 300 streams found on a typical iOS device. This incomplete support necessitates manual validation and the development of updated parsers to ensure that investigators can access and interpret the full scope of data available within the Biome framework.
While the Biome framework itself is not a security vulnerability or malware, the detailed data it retains reinforces the importance of keeping iOS devices updated. Recent security incidents involving zero-click exploits and other vulnerabilities highlight the ongoing need for users to apply software updates promptly to protect their devices and data, even when the underlying framework is designed for legitimate functionality.