Application Intents
Overview
Section titled “Overview”Evidence: Application Intents
Description: Collect Application Intents
Category: System
Platform: macos
Short Name: appint
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC app intents stream records app intents and Siri-donated user actions, capturing the owning application together with the intent class and verb, for example sending a message, starting a call, or playing media.
Data Collected
Section titled “Data Collected”This collector gathers structured data about donated app intents, including the application, intent class and verb, and timing. Results are recorded in app_intents.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records application intent events into app_intents.
Forensic Value
Section titled “Forensic Value”Donated app intents reveal user actions such as messaging, calling, and media playback even when the originating app’s own logs are unavailable, aiding activity timeline reconstruction.