Audio Output Route
Overview
Section titled “Overview”Evidence: Audio Output Route
Description: Collect Audio Output Route
Category: System
Platform: macos
Short Name: audout
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC audio output route stream records the active audio output device over time, including built-in speakers, headphones, and Bluetooth audio devices such as AirPods.
Data Collected
Section titled “Data Collected”This collector gathers structured data about the active audio output route, including route name, type, and timing. Results are recorded in audio_output_route.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records audio output route events into audio_output_route.
Forensic Value
Section titled “Forensic Value”Audio routing to external or wireless devices can indicate covert listening, presence of paired peripherals, and user activity patterns.