activity-reconstruction

What problem does it solve?

This skill solves the critical forensic challenge of manually piecing together fragmented iOS device activity data from multiple disparate system artifacts to answer key questions about user actions, device location, and event timelines during investigations.

Core Features & Use Cases

• Multi-source timeline reconstruction: Aggregates data from knowledgeC.db, Safari history, Photos, location logs, cellular usage records, and power event logs to build a complete picture of device activity.
• Forensic-grade evidence validation: Ties every timeline event to a specific database row or plist entry to ensure findings are defensible and admissible in legal proceedings.
• Use case: For a spyware investigation, use this skill to correlate app usage, location visits, and web browsing activity around a suspect time window to confirm or refute alibis and identify anomalous behavior.

Quick Start

Use the activity-reconstruction skill to build a full, source-attributed timeline of iOS device activity for the provided device backup and specified investigation time window.