skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

activity-reconstruction

Reconstruct evidence-backed iOS device activity timelines from system artifacts.

11|1|Updated May 4, 2026
Search Tags:#digital-forensics#timeline-analysis#forensic-timeline#ios-forensics#activity-reconstruction#knowledgeC.db#device-investigation
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill activity-reconstruction
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: activity-reconstruction
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/ios-forensics/skills/activity-reconstruction
Command: npx skills add https://github.com/dreadnode/capabilities --skill activity-reconstruction

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the critical forensic challenge of manually piecing together fragmented iOS device activity data from multiple disparate system artifacts to answer key questions about user actions, device location, and event timelines during investigations.

Core Features & Use Cases

  • Multi-source timeline reconstruction: Aggregates data from knowledgeC.db, Safari history, Photos, location logs, cellular usage records, and power event logs to build a complete picture of device activity.
  • Forensic-grade evidence validation: Ties every timeline event to a specific database row or plist entry to ensure findings are defensible and admissible in legal proceedings.
  • Use case: For a spyware investigation, use this skill to correlate app usage, location visits, and web browsing activity around a suspect time window to confirm or refute alibis and identify anomalous behavior.

Quick Start

Use the activity-reconstruction skill to build a full, source-attributed timeline of iOS device activity for the provided device backup and specified investigation time window.

Frequently Asked Questions about activity-reconstruction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct an iOS activity timeline from knowledgeC.db and other artifacts for a forensic investigation?▼

Reconstruct an iOS forensic timeline by correlating knowledgeC.db, Safari history, location logs, cellular usage records, and power event logs. This process aggregates disparate system artifacts into a single, source-attributed timeline to answer questions about user actions and device location during investigations.

Can I build a defensible timeline of iOS user activity that is admissible in legal proceedings?▼

Yes, you can build defensible timelines by tying every event to a specific database row or plist entry. This source attribution ensures your forensic findings regarding iOS device usage patterns and alibi verification remain evidence-backed and admissible.

What is the best way to analyze iOS backup data for spyware activity and anomalous behavior?▼

The best way to analyze iOS backup data for spyware is correlating app usage, location visits, and web browsing activity around a suspect time window. This multi-source timeline reconstruction identifies anomalous behavior and confirms or refutes alibis.

Does iOS forensic timeline reconstruction work with both backup and full file system acquisitions?▼

Yes, timeline reconstruction works across both iOS backup and full file system acquisitions. It extracts and correlates user activity data from these sources to provide complete event coverage for incident timeline reconstruction.

How do power event logs and cellular usage records contribute to device usage pattern review?▼

Power event logs and cellular usage records provide timestamped system and network context that correlates with knowledgeC.db entries. Combining these artifacts during device usage pattern review establishes a continuous, precise timeline of user activity.

Why does manually piecing together fragmented iOS system artifacts fail for incident timeline reconstruction?▼

Manual piecing fails because disparate iOS artifacts lack unified timestamp correlation and source attribution. Automated timeline reconstruction applies precise timestamp conversion across databases to build a complete, defensible incident timeline.

Related Skills

Explore More Legal & Compliance Skills→
dreadnodedreadnode
11

spyware-hunt

Correlate STIX indicators with iOS system artifacts to detect mercenary spyware.

Official
Advanced
SherifEldeebSherifEldeeb
5

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

Community
Advanced
takusaotometakusaotome
5

network-incident-analyzer

Correlate multi-vendor network device logs into UTC-normalized incident reports.

Community
Advanced
nrminornrminor

vcs-detect

Detect whether a project uses jj or git for version control.

Community
Basic