Media Now Playing
Overview
Section titled “Overview”Evidence: Media Now Playing
Description: Collect Media Now Playing
Category: System
Platform: macos
Short Name: medianp
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”The KnowledgeC now-playing stream records media playback events with the playing application and, where available, the track title, artist, and album.
Data Collected
Section titled “Data Collected”This collector gathers structured data about media now playing, including the application, media metadata, and timing. Results are recorded in media_now_playing.
Collection Method
Section titled “Collection Method”This collector reads KnowledgeC databases under user profiles and records now-playing events into media_now_playing.
Forensic Value
Section titled “Forensic Value”Media playback ties a user to the device at specific times and can reveal applications and content in use during an incident window.