Apple SEGB (Biome store)
| Format | Apple SEGB (Biome store) |
|---|---|
| Short name | SEGB |
| Category | log |
| Platforms | macOS, iOS |
| Crush support | Supported (SegbParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's Segmented Binary format — the on-disk storage container for iOS and macOS Biome data, which replaced much of KnowledgeC from iOS 16 onwards. Two versions: SEGB v1 (iOS 14-16, 56-byte header ending with 'SEGB' in ASCII, 32-byte record headers with two Mac Absolute Time timestamps) and SEGB v2 (iOS 17+, 32-byte header, entries + trailer section). Each record payload is a protobuf — requiring schema knowledge for full decoding. Current devices hold 300+ Biome stream folders, dozens of them forensically relevant, covering: app focus/usage (replaces KnowledgeC), app installs, Safari history, Siri/AppIntent interactions (may contain deleted iMessages and Snapchat activity), CarPlay connections, notifications, location events, and screen activity. Located at /private/var/mobile/Library/Biome/streams/ and /private/var/db/biome/streams/ — each stream has 'local/' (device) and 'remote/' (iCloud-synced from other devices) subdirectories. Tombstone/ folder contains expired/deleted records — partially recoverable. Filenames are Mac Absolute Time floats (insert decimal 6 places from end). Data survives app deletion and may outlast primary databases.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 53 45 47 42 | SEGB | SEGB v2 signature at offset 0 (32-byte header) |
| offset 52 (0x34) | 53 45 47 42 | SEGB | SEGB v1 signature at offset 52 (within 56-byte header) |
Known extensions
None recorded
References
- ccl_segb — CCL parser for SEGB v1 and v2 https://github.com/cclgroupltd/ccl-segb
- iOS 16 Biome breakdown Part 1 — SEGB format (D20 Forensics, 2022) https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html
- Understanding and decoding the newest iOS SEGB format (Cellebrite, 2023) https://cellebrite.com/en/blog/understanding-and-decoding-the-newest-ios-segb-format/
- Analyzing iOS Biome AppIntent files (Blue Crew Forensics, John Hyla, 2022) https://bluecrewforensics.com/2022/03/07/ios-app-intents/
- Bringing it back with Biome data (Magnet Forensics, 2023) https://www.magnetforensics.com/blog/bringing-it-back-with-biome-data/
- 84 Streams Later: Exploring the Evolution of Apple Biome in iOS (Mattia Epifani, 2026) https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html
- Beyond the C — SEGB and Biome Forensics with crush (beBinary) https://bebinary4n6.blogspot.com/2026/05/beyond-c-segb-and-biome-forensics-with.html
Cite this entry
Crush Format Reference, “Apple SEGB (Biome store)”. https://kalink0.github.io/crush-forensics/formats/segb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction