This tweet seems to imply it’s logs, json, plist and SQLite DB.
replyBiome — /private/var/mobile/Library/Biome/streams/.../Notification/segments/ — the raw title/body logs
2. BulletinBoard + UserNotificationsCore — /var/mobile/Library/{BulletinBoard,UserNotificationsCore}/.{json,plist} — delivered + dismissed state
3. CoreDuet — /var/mobile/Library/CoreDuet/coreduetdClassD.db — SQLite that re-ingests Biome events
I don’t think they are correct
replyYou're speculating. "Marked for deletion" could mean after you dismiss it, not just after you delete the whole app.
replyi'll speculate further: it could've been on the dismiss notification code, and when you delete the app the OS dismisses the removed app's notifications, triggering the same code path.
replyin this case as per reporting, defendant removed the app. unclear if they first dismissed them.
SQLite WAL?
replyWhy do you think they aren't the same thing?
reply