Where apps hide your files
Screen Time has no export button, and its numbers are not in a file called ScreenTime. They sit in a system database called knowledgeC.db, in Biome activity streams on recent macOS versions, and in a few Screen Time containers. Here is where each one is, which need Full Disk Access, and what you can safely do with them.
The per-user database on your Mac:
~/Library/Application Support/Knowledge/knowledgeC.db
Next to it you will see knowledgeC.db-wal and knowledgeC.db-shm. All three belong together. On the Mac used for this guide the folder holds about 13 MB in total.
A second, system-wide copy lives here:
/private/var/db/CoreDuet/Knowledge/knowledgeC.db
The folder /private/var/db/CoreDuet exists, but Terminal got "Operation not permitted" when listing its Knowledge subfolder, because macOS protects it. An app or Terminal needs Full Disk Access to look inside. Community write-ups describe this system copy as the one that carries data synced from your other Apple devices, but Apple does not document the file, so treat that as likely and not certain.
To open the per-user folder in Finder, choose Go > Go to Folder (⇧⌘G) and paste ~/Library/Application Support/Knowledge. From Terminal:
open ~/Library/Application\ Support/Knowledge
These folders exist on the Mac used for this guide:
| Path | Role |
|---|---|
~/Library/Group Containers/group.com.apple.ScreenTime | Shared storage for the Screen Time system and its extensions. |
~/Library/Containers/com.apple.ScreenTimeAgent | The container for the Screen Time agent, the background process behind limits and downtime. |
~/Library/Containers/com.apple.UsageTrackingAgent | A container for the usage tracking agent. |
~/Library/Biome/streams/restricted/ScreenTime.AppUsage | A Biome stream, Apple's newer event store. Beside it sit App.InFocus and App.WebUsage. |
Which of these holds your data varies between macOS releases, and Apple publishes no layout for any of them. On the Mac used for this guide, the ScreenTime.AppUsage and App.InFocus streams had been written to that same day, so recent macOS versions record app usage in Biome as well as, or instead of, knowledgeC.db. The Biome folder is the larger one (hundreds of megabytes here), and its streams are binary files with numeric names, not readable reports.
knowledgeC.db is a SQLite database. It is the store behind several system features, not only Screen Time: it records events such as which app was in the foreground and when. Researchers and forensic guides describe app usage as rows in a table named ZOBJECT, labelled by stream names that begin with /app/. Those details are reverse-engineered from the file, not documented by Apple, and they have changed between macOS versions.
This guide does not show how to read the contents. Opening the database in a SQLite tool reads private data about everything you have used, and a careless query on the live file can lock it. If you want your numbers, look at them where Apple shows them:
Copy all three files together, because the -wal file holds recent changes not yet merged into the main file. Copy them to a different folder, never edit the originals, and work on the copy. A copy of knowledgeC.db alone can miss the latest hours.
These read-only commands show names, sizes and dates, never contents:
ls -la ~/Library/Application\ Support/Knowledge
du -sh ~/Library/Application\ Support/Knowledge
If the folder is missing or tiny, Screen Time or the related system services may be off or used little on this Mac. If you only see the Mac's data and not your iPhone's, turn on Share across devices in the Screen Time pane, and check the iPhone is signed into the same Apple Account.
The Knowledge folder is small compared to Mail or Photos, so size is rarely the reason to look. If you want less recorded, the supported route is Screen Time itself. Apple's Sequoia guide says to scroll down in the Screen Time pane and turn off App & Website Activity; Share across devices controls whether usage from your other devices signed in to the same Apple Account is included.
Do not delete knowledgeC.db. Other parts of macOS use it, and deleting a database that is in use can corrupt it. Apple's Screen Time controls are the safe way to stop recording.
The Screen Time pane changes between releases: Apple's guide for its newest macOS talks about Daily Average, Screen Time Schedule and Time Allowances, labels Sequoia does not use. The file locations above were checked on Sequoia, so on a newer release confirm them with ls, and rely on the Screen Time pane for anything you need.
All of it sits in ~/Library or /private/var, so Spotlight and Finder searches leave it out. knowledgeC.db is also not a document, so nothing in Finder points you to it.
Typing knowledgeC into Everywhere lists the per-user database with its -wal and -shm files, and ScreenTime.AppUsage finds the Biome stream; both sit in parts of ~/Library it indexes without extra permission. The system copy under /private/var/db, and the Screen Time containers, need Full Disk Access, which it asks for during setup. It matches file names only and cannot read the database. ⌘↵ reveals a result in Finder.
The long-documented per-user database is ~/Library/Application Support/Knowledge/knowledgeC.db, with -wal and -shm files beside it. Recent macOS versions also write app usage to Biome streams such as ~/Library/Biome/streams/restricted/ScreenTime.AppUsage.
Apple offers no export. You can view usage in System Settings > Screen Time. The databases hold the raw events, but their format is undocumented and they hold private data.
No. Other macOS features use it and deleting a live database can corrupt it. Turn off App & Website Activity in Screen Time settings if you want it to stop recording.
Only if Share across devices is on in Screen Time settings, and both devices use the same Apple Account. Where the synced data is stored is not documented by Apple.
Everywhere keeps track of every file on your Mac — including the folders Spotlight hides and drives you have unplugged. Free for a day, then $19 once.
Version 2.20.3 · macOS 13+ · 4.7 MB · notarised