Description

This script parses records from macOS and IOS Biome SEGB files, which are believed to monitor user activity with a view to making context-sensitive suggestions that improve user experience. This functionality is described in the following article:

As things stand currently, there are two versions of these files, one having a ‘SEGB’ signature at offset-52 and one having a ‘SEGB’ signature at offset-0. The script refers to these versions as V1 and V2 respectively.

  • In V1, the records are located immediately after the 56-byte file-header.
  • In V2, the records are located using trailer-records to be found at the end of the file.

Both types of file include timestamps pertaining to the file-header and the records themselves.

In addition, the records also have a numeric state field indicating whether they’re used (1) or unused/deleted (3). Tests indicate that the latter only ever contain null-bytes.

Most current records use protocol buffers (aka protobufs) to store data (aka messages) albeit some binary property-list streams have been observed as well.

Protobuf messages are encoded/decoded using protocol-format files, which will usually have a *.proto file-extension. The protocol-format file lists the type of each field, its name, and a numeric ID. Protobuf messages may be nested.

The encoding process uses the 6-wire-types specified in the following article:

In order to parse protobufs without the associated protocol-format files, the script uses the ProtoUntyped .NET library:

Whilst this works reasonably well, only the numeric ID can be produced by the script and some values must be interpreted on a best-guess basis. This is because one cannot fully interpret a protobuf message without the corresponding *.proto file. This point is made in the When are Protocol Buffers not a Good Fit? section of the following article:

Accordingly, the output of the script may differ to other tools, CyberChef for example:

The script writes its output to bookmarks, a logical evidence file (LEF), and the console.

It is worthy of note that -

  • To process records (aka artifacts), the option to process all or tagged items must be used.
  • Each file is assigned an incremental-ID as is the record in each file. This enables the bookmarks created by the script to be mapped to the records written to the logical evidence file (the bookmarks link to the original data, not the records written to the LEF).
  • Research indicate that each record’s timestamp relates to when the associated activity was recorded, not when it took place.
  • The script will exclude unused/deleted records by default albeit there is an option to override this behaviour.
  • The LEF will contain two versions of each protobuf record, one raw and one parsed. The user can also opt to include a .NET version of each record encoded as JSON. The latter may prove useful when the examiner wishes to examine/decode individual values, e.g., base-64 encoded values, which can be decoded/extracted using the JSON Viewer Plugin EnScript application.
  • The best way to view the decoded content of large protobufs is to examine the output LEF - the bookmarks created by the script may not display properly.
  • Decoded protobuf data should be viewed as UTF-8 with line breaks.

This script was developed for use in EnCase training. For more details, please click the following link:

Releases

Release
Size
Date
Biome SEGB Record Parser 1.0
706.7 KB
  |  
Aug 19, 2025
More info Less info
Product compatibility
Version 1.0.0
Release notes

First release.

Developed/tested using EnCase 25.0.2.00.63.

Languages
English

Unsubscribe from notifications

You are receiving release updates for this item because you have subscribed to the following products:
If you unsubscribe, you will no longer receive any notifications for these products.
Tip: to update your subscription preferences, go to Manage Subscriptions from your Dashboard, uncheck the products you no longer want to receive notifications for, and click 'Save'.

Marketplace Terms of Service

In order to continue, you must accept the updated Marketplace Terms of Service.
Since you are downloading an app from the OpenText Marketplace, you need to accept the updated Marketplace Terms of Service before you can continue. Use the link to review the Marketplace Terms of Service. Once complete check the, "I accept the Marketplace Terms of Service" box below and click accept to continue your download.


Your download has begun...

Your download has begun

Related content and resources

Your browser is not supported!

Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox

release-rel-2025-08-01-6423 | Tue Aug 5 17:23:03 PDT 2025