{"id":12537,"date":"2019-10-28T09:33:00","date_gmt":"2019-10-28T14:33:00","guid":{"rendered":"https:\/\/rud.is\/b\/?p=12537"},"modified":"2019-10-28T09:33:00","modified_gmt":"2019-10-28T14:33:00","slug":"spelunking-macos-screentime-app-usage-with-r","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/","title":{"rendered":"Spelunking macOS ‘ScreenTime’ App Usage with R"},"content":{"rendered":"

Apple has brought Screen Time<\/a> to macOS for some time now and that means it has to store this data somewhere<\/em>. Thankfully, Sarah Edwards has foraged through the macOS filesystem for us and explained where these bits of knowledge are in her post, Knowledge is Power! Using the macOS\/iOS knowledgeC.db Database to Determine Precise User and Application Usage<\/a>, which ultimately reveals the data lurks in ~\/Library\/Application Support\/Knowledge\/knowledgeC.db<\/code>. Sarah also has a neat little Python utility dubbed APOLLO<\/a> (Apple Pattern of Life Lazy Output’er) which has a smattering of knowledgeC.db<\/code> canned SQL queries<\/a> that cover a myriad of tracked items.<\/p>\n

Today, we’ll show how to work with this database in R and the {tidyverse} to paint our own pictures of application usage.<\/p>\n

There are quite a number of tables in the knowledgeC.db<\/code> SQLite 3 database:<\/p>\n

\"\"<\/a><\/p>\n

That visual schema was created in OmniGraffle via a small R script<\/a> that uses the OmniGraffle automation framework. The OmniGraffle source files are also available upon request.<\/p>\n

Most of the interesting bits (for any tracking-related spelunking) are in the ZOBJECT<\/code> table and to get a full picture of usage we’ll need to join it with some other tables that are connected via a few foreign keys:<\/p>\n

\"\"<\/a><\/p>\n

There are a few ways to do this in {tidyverse} R. The first is an extended straight SQL riff off of one of Sarah’s original queries:<\/p>\n

library(hrbrthemes) # for ggplot2 machinations\nlibrary(tidyverse)\n\n# source the knowledge db\nkdb <- src_sqlite(\"~\/Library\/Application Support\/Knowledge\/knowledgeC.db\")\n\ntbl(\n  kdb, \n  sql('\nSELECT\n  ZOBJECT.ZVALUESTRING AS \"app\", \n    (ZOBJECT.ZENDDATE - ZOBJECT.ZSTARTDATE) AS \"usage\",  \n    CASE ZOBJECT.ZSTARTDAYOFWEEK \n      WHEN \"1\" THEN \"Sunday\"\n      WHEN \"2\" THEN \"Monday\"\n      WHEN \"3\" THEN \"Tuesday\"\n      WHEN \"4\" THEN \"Wednesday\"\n      WHEN \"5\" THEN \"Thursday\"\n      WHEN \"6\" THEN \"Friday\"\n      WHEN \"7\" THEN \"Saturday\"\n    END \"dow\",\n    ZOBJECT.ZSECONDSFROMGMT\/3600 AS \"tz\",\n    DATETIME(ZOBJECT.ZSTARTDATE + 978307200, \\'UNIXEPOCH\\') as \"start_time\", \n    DATETIME(ZOBJECT.ZENDDATE + 978307200, \\'UNIXEPOCH\\') as \"end_time\",\n    DATETIME(ZOBJECT.ZCREATIONDATE + 978307200, \\'UNIXEPOCH\\') as \"created_at\", \n    CASE ZMODEL\n      WHEN ZMODEL THEN ZMODEL\n      ELSE \"Other\"\n    END \"source\"\n  FROM\n    ZOBJECT \n    LEFT JOIN\n      ZSTRUCTUREDMETADATA \n    ON ZOBJECT.ZSTRUCTUREDMETADATA = ZSTRUCTUREDMETADATA.Z_PK \n    LEFT JOIN\n      ZSOURCE \n    ON ZOBJECT.ZSOURCE = ZSOURCE.Z_PK \n    LEFT JOIN\n      ZSYNCPEER\n    ON ZSOURCE.ZDEVICEID = ZSYNCPEER.ZDEVICEID\n  WHERE\n    ZSTREAMNAME = \"\/app\/usage\"'\n  )) -> usage\n\nusage\n## # Source:   SQL [?? x 8]\n## # Database: sqlite 3.29.0 [\/Users\/johndoe\/Library\/Application Support\/Knowledge\/knowledgeC.db]\n##    app                      usage dow         tz start_time          end_time            created_at         source       \n##    <chr>                    <int> <chr>    <int> <chr>               <chr>               <chr>              <chr>        \n##  1 com.bitrock.appinstaller    15 Friday      -4 2019-10-05 01:11:27 2019-10-05 01:11:42 2019-10-05 01:11:\u2026 MacBookPro13\u2026\n##  2 com.tinyspeck.slackmacg\u2026  4379 Tuesday     -4 2019-10-01 13:19:24 2019-10-01 14:32:23 2019-10-01 14:32:\u2026 Other        \n##  3 com.tinyspeck.slackmacg\u2026  1167 Tuesday     -4 2019-10-01 18:19:24 2019-10-01 18:38:51 2019-10-01 18:38:\u2026 Other        \n##  4 com.tinyspeck.slackmacg\u2026  1316 Tuesday     -4 2019-10-01 19:13:49 2019-10-01 19:35:45 2019-10-01 19:35:\u2026 Other        \n##  5 com.tinyspeck.slackmacg\u2026 12053 Thursday    -4 2019-10-03 12:25:18 2019-10-03 15:46:11 2019-10-03 15:46:\u2026 Other        \n##  6 com.tinyspeck.slackmacg\u2026  1258 Thursday    -4 2019-10-03 15:50:16 2019-10-03 16:11:14 2019-10-03 16:11:\u2026 Other        \n##  7 com.tinyspeck.slackmacg\u2026  2545 Thursday    -4 2019-10-03 16:24:30 2019-10-03 17:06:55 2019-10-03 17:06:\u2026 Other        \n##  8 com.tinyspeck.slackmacg\u2026   303 Thursday    -4 2019-10-03 17:17:10 2019-10-03 17:22:13 2019-10-03 17:22:\u2026 Other        \n##  9 com.tinyspeck.slackmacg\u2026  9969 Thursday    -4 2019-10-03 17:33:38 2019-10-03 20:19:47 2019-10-03 20:19:\u2026 Other        \n## 10 com.tinyspeck.slackmacg\u2026  2813 Thursday    -4 2019-10-03 20:19:52 2019-10-03 21:06:45 2019-10-03 21:06:\u2026 Other        \n## # \u2026 with more rows\n<\/code><\/pre>\n
Before explaining what that query does, let’s rewrite it {dbplyr}-style:<\/p>\n
tbl(kdb, \"ZOBJECT\") %>% \n  mutate(\n    created_at = datetime(ZCREATIONDATE + 978307200, \"UNIXEPOCH\", \"LOCALTIME\"),\n    start_dow = case_when(\n      ZSTARTDAYOFWEEK == 1 ~ \"Sunday\",\n      ZSTARTDAYOFWEEK == 2 ~ \"Monday\",\n      ZSTARTDAYOFWEEK == 3 ~ \"Tuesday\",\n      ZSTARTDAYOFWEEK == 4 ~ \"Wednesday\",\n      ZSTARTDAYOFWEEK == 5 ~ \"Thursday\",\n      ZSTARTDAYOFWEEK == 6 ~ \"Friday\",\n      ZSTARTDAYOFWEEK == 7 ~ \"Saturday\"\n    ),\n    start_time = datetime(ZSTARTDATE + 978307200, \"UNIXEPOCH\", \"LOCALTIME\"),\n    end_time = datetime(ZENDDATE + 978307200, \"UNIXEPOCH\", \"LOCALTIME\"),\n    usage = (ZENDDATE - ZSTARTDATE),\n    tz = ZSECONDSFROMGMT\/3600 \n  ) %>% \n  left_join(tbl(kdb, \"ZSTRUCTUREDMETADATA\"), c(\"ZSTRUCTUREDMETADATA\" = \"Z_PK\")) %>% \n  left_join(tbl(kdb, \"ZSOURCE\"), c(\"ZSOURCE\" = \"Z_PK\")) %>% \n  left_join(tbl(kdb, \"ZSYNCPEER\"), \"ZDEVICEID\") %>% \n  filter(ZSTREAMNAME == \"\/app\/usage\")  %>% \n  select(\n    app = ZVALUESTRING, created_at, start_dow, start_time, end_time, usage, tz, source = ZMODEL\n  ) %>% \n  mutate(source = ifelse(is.na(source), \"Other\", source)) %>% \n  collect() %>% \n  mutate_at(vars(created_at, start_time, end_time), as.POSIXct) -> usage\n<\/code><\/pre>\n
What we’re doing is pulling out the day of week, start\/end usage times & timezone info, app bundle id, source of the app interactions and the total usage time for each entry along with when that entry was created. We need to do some maths since Apple stores time-y whime-y info in its own custom format, plus we need to convert numeric DOW to labeled DOW.<\/p>\n
The bundle ids are pretty readable, but they’re not really intended for human consumption, so we’ll make a translation table for the bundle id to app name by using the mdls<\/code><\/a> command.<\/p>\n
list.files(\n  c(\"\/Applications\", \"\/System\/Library\/CoreServices\", \"\/Applications\/Utilities\", \"\/System\/Applications\"), # main places apps are stored (there are potentially more but this is sufficient for our needs)\n  pattern = \"\\\\.app$\", \n  full.names = TRUE\n) -> apps\n\nx <- sys::exec_internal(\"mdls\", c(\"-name\", \"kMDItemCFBundleIdentifier\", \"-r\", apps))\n\n# mdls null (\\0) terminates each entry so we have to do some raw surgery to get it into a format we can use\nx$stdout[x$stdout == as.raw(0)] <- as.raw(0x0a)\n\ntibble(\n  name = gsub(\"\\\\.app$\", \"\", basename(apps)),\n  app = read_lines(x$stdout) \n) -> app_trans\n\napp_trans\n## # A tibble: 270 x 2\n##    name                    app                                    \n##    <chr>                   <chr>                                  \n##  1 1Password 7             com.agilebits.onepassword7             \n##  2 Adium                   com.adiumX.adiumX                      \n##  3 Agenda                  com.momenta.agenda.macos               \n##  4 Alfred 4                com.runningwithcrayons.Alfred          \n##  5 Amazon Music            com.amazon.music                       \n##  6 Android File Transfer   com.google.android.mtpviewer           \n##  7 Awsaml                  com.rapid7.awsaml                      \n##  8 Bartender 2             com.surteesstudios.Bartender           \n##  9 BBEdit                  com.barebones.bbedit                   \n## 10 BitdefenderVirusScanner com.bitdefender.BitdefenderVirusScanner\n## # \u2026 with 260 more rows\n<\/code><\/pre>\n
The usage info goes back ~30 days, so let’s do a quick summary of the top 10 apps and their total usage (in hours):<\/p>\n
usage %>% \n  group_by(app) %>% \n  summarise(first = min(start_time), last = max(end_time), total = sum(usage, na.rm=TRUE)) %>% \n  ungroup() %>% \n  mutate(total = total \/ 60 \/ 60) %>% # hours\n  arrange(desc(total)) %>% \n  left_join(app_trans) -> overall_usage\n\noverall_usage %>% \n  slice(1:10) %>% \n  left_join(app_trans) %>%\n  mutate(name = fct_inorder(name) %>% fct_rev()) %>%\n  ggplot(aes(x=total, y=name)) + \n  geom_segment(aes(xend=0, yend=name), size=5, color = ft_cols$slate) +\n  scale_x_comma(position = \"top\") +\n  labs(\n    x = \"Total Usage (hrs)\", y = NULL,\n    title = glue::glue('App usage in the past {round(as.numeric(max(usage$end_time) - min(usage$start_time), \"days\"))} days')\n  ) +\n  theme_ft_rc(grid=\"X\")\n<\/code><\/pre>\n
\"\"<\/a><\/p>\n
There’s a YUGE flaw in the current way macOS tracks application usage. Unlike iOS where apps really don’t run simultaneously (with iPadOS they kinda<\/em> can\/do, now), macOS apps are usually started and left open along with other apps. Apple doesn’t do a great job identifying only active app usage activity so many of these usage numbers are heavily inflated. Hopefully that will be fixed by macOS 10.15.<\/p>\n
We have more data at our disposal, so let’s see when these apps get used. To do that, we’ll use segments to plot individual usage tracks and color them by weekday\/weekend usage (still limiting to top 10 for blog brevity):<\/p>\n
usage %>% \n  filter(app %in% overall_usage$app[1:10]) %>% \n  left_join(app_trans) %>%\n  mutate(name = factor(name, levels = rev(overall_usage$name[1:10]))) %>% \n  ggplot() +\n  geom_segment(\n    aes(\n      x = start_time, xend = end_time, y = name, yend = name, \n      color = ifelse(start_dow %in% c(\"Saturday\", \"Sunday\"), \"Weekend\", \"Weekday\")\n    ),\n    size = 10,\n  ) +\n  scale_x_datetime(position = \"top\") +\n  scale_colour_manual(\n    name = NULL,\n    values = c(\n      \"Weekend\" = ft_cols$light_blue, \n      \"Weekday\" = ft_cols$green\n    )\n  ) +\n  guides(\n    colour = guide_legend(override.aes = list(size = 1))\n  ) +\n  labs(\n    x = NULL, y = NULL,\n    title = glue::glue('Top 10 App usage on this Mac in the past {round(as.numeric(max(usage$end_time) - min(usage$start_time), \"days\"))} days'),\n    subtitle = \"Each segment represents that app being 'up' (Open to Quit).\\nUnfortunately, this is what Screen Time uses for its calculations on macOS\"\n  ) +\n  theme_ft_rc(grid=\"X\") +\n  theme(legend.position = c(1, 1.25)) +\n  theme(legend.justification = \"right\")\n<\/code><\/pre>\n
\"\"<\/a><\/p>\n
I’m not entirely sure “on this Mac” is completely accurate since I think this syncs across all active Screen Time devices due to this (n<\/em> is in seconds):<\/p>\n
count(usage, source, wt=usage, sort=TRUE)\n## # A tibble: 2 x 2\n##   source               n\n##   <chr>            <int>\n## 1 Other          4851610\n## 2 MacBookPro13,2 1634137\n<\/code><\/pre>\n
The “Other” appears to be the work-dev Mac but it doesn’t have the identifier mapped so I think that means it’s the local one and that the above chart is looking at Screen Time across all devices. I literally (right before this sentence) enabled Screen Time on my iPhone so we’ll see if that ends up in the database and I’ll post a quick update if it does.<\/p>\n
We’ll take one last look by day of week and use a heatmap to see the results:<\/p>\n
count(usage, start_dow, app, wt=usage\/60\/60) %>% \n  left_join(app_trans) %>%\n  filter(app %in% overall_usage$app[1:10]) %>% \n  mutate(name = factor(name, levels = rev(overall_usage$name[1:10]))) %>% \n  mutate(start_dow = factor(start_dow, c(\"Sunday\", \"Monday\", \"Tuesday\", \"Wednesday\", \"Thursday\", \"Friday\", \"Saturday\"))) %>% \n  ggplot() +\n  geom_tile(aes(start_dow, name, fill = n), color = \"#252a32\", size = 0.75) +\n  scale_x_discrete(expand = c(0, 0.5), position = \"top\") +\n  scale_y_discrete(expand = c(0, 0.5)) +\n  scale_fill_viridis_c(direction = -1, option = \"magma\", name = \"Usage (hrs)\") +\n  labs(\n    x = NULL, y = NULL,\n    title = \"Top 10 App usage by day of week\"\n  ) +\n  theme_ft_rc(grid=\"\")\n<\/code><\/pre>\n
\"\"<\/a><\/p>\n
I really need to get into the habit of using the RStudio Server access features of RSwitch<\/a> over Chrome so I can get RSwitch into the top 10, but some habits (and bookmarks) die hard.<\/p>\n
FIN<\/h3>\n
Apple’s Screen Time also tracks “category”, which is something we can pick up from each application’s embedded metadata. We’ll do that in a follow-up post along with seeing whether we can capture iOS usage now that I’ve enabled Screen Time on those devices as well.<\/p>\n
Keep spelunking the knowledgeC.db<\/code> table(s) and blog about or reply in the comments with any interesting nuggets you find.<\/p>\n","protected":false},"excerpt":{"rendered":"
Apple has brought Screen Time to macOS for some time now and that means it has to store this data somewhere. Thankfully, Sarah Edwards has foraged through the macOS filesystem for us and explained where these bits of knowledge are in her post, Knowledge is Power! Using the macOS\/iOS knowledgeC.db Database to Determine Precise User […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[780,91],"tags":[],"class_list":["post-12537","post","type-post","status-publish","format-standard","hentry","category-macos","category-r"],"yoast_head":"\nSpelunking macOS 'ScreenTime' App Usage with R - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Spelunking macOS 'ScreenTime' App Usage with R - rud.is\" \/>\n<meta property=\"og:description\" content=\"Apple has brought Screen Time to macOS for some time now and that means it has to store this data somewhere. Thankfully, Sarah Edwards has foraged through the macOS filesystem for us and explained where these bits of knowledge are in her post, Knowledge is Power! Using the macOS\/iOS knowledgeC.db Database to Determine Precise User […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2019-10-28T14:33:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"Spelunking macOS ‘ScreenTime’ App Usage with R\",\"datePublished\":\"2019-10-28T14:33:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/\"},\"wordCount\":703,\"commentCount\":8,\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/knowledgeC.png\",\"articleSection\":[\"macOS\",\"R\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/\",\"name\":\"Spelunking macOS 'ScreenTime' App Usage with R - rud.is\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/knowledgeC.png\",\"datePublished\":\"2019-10-28T14:33:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/knowledgeC.png?fit=1949%2C4313&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/knowledgeC.png?fit=1949%2C4313&ssl=1\",\"width\":1949,\"height\":4313},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2019\\\/10\\\/28\\\/spelunking-macos-screentime-app-usage-with-r\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/rud.is\\\/b\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Spelunking macOS ‘ScreenTime’ App Usage with R\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/\",\"name\":\"rud.is\",\"description\":\""In God we trust. All others must bring data"\",\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rud.is\\\/b\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\\\/\\\/rud.is\"],\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/author\\\/hrbrmstr\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Spelunking macOS 'ScreenTime' App Usage with R - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/","og_locale":"en_US","og_type":"article","og_title":"Spelunking macOS 'ScreenTime' App Usage with R - rud.is","og_description":"Apple has brought Screen Time to macOS for some time now and that means it has to store this data somewhere. Thankfully, Sarah Edwards has foraged through the macOS filesystem for us and explained where these bits of knowledge are in her post, Knowledge is Power! Using the macOS\/iOS knowledgeC.db Database to Determine Precise User […]","og_url":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/","og_site_name":"rud.is","article_published_time":"2019-10-28T14:33:00+00:00","og_image":[{"url":"https:\/\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png","type":"","width":"","height":""}],"author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"Spelunking macOS ‘ScreenTime’ App Usage with R","datePublished":"2019-10-28T14:33:00+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/"},"wordCount":703,"commentCount":8,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"image":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png","articleSection":["macOS","R"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/","url":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/","name":"Spelunking macOS 'ScreenTime' App Usage with R - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"primaryImageOfPage":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#primaryimage"},"image":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#primaryimage"},"thumbnailUrl":"https:\/\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png","datePublished":"2019-10-28T14:33:00+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#primaryimage","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png?fit=1949%2C4313&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/10\/knowledgeC.png?fit=1949%2C4313&ssl=1","width":1949,"height":4313},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2019\/10\/28\/spelunking-macos-screentime-app-usage-with-r\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"Spelunking macOS ‘ScreenTime’ App Usage with R"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":""In God we trust. All others must bring data"","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-3gd","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":12878,"url":"https:\/\/rud.is\/b\/2021\/01\/16\/new-swiftr-chapter-up-building-an-r-backed-swiftui-macos-app\/","url_meta":{"origin":12537,"position":0},"title":"New SwiftR Chapter Up: Building an R-backed SwiftUI macOS App","author":"hrbrmstr","date":"2021-01-16","format":false,"excerpt":"Last week I introduced a new bookdown series on how to embed R into a macOS Swift application. The initial chapters focused on core concepts and showed how to build a macOS compiled, binary command line application that uses embedded R for some functionality. This week, a new chapter is\u2026","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/rud.is\/b\/category\/apple\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":12645,"url":"https:\/\/rud.is\/b\/2020\/02\/06\/prying-r-script-files-away-from-xcode-et-al-on-macos\/","url_meta":{"origin":12537,"position":1},"title":"Prying “.R” Script Files Away from Xcode (et al) on macOS","author":"hrbrmstr","date":"2020-02-06","format":false,"excerpt":"As the maintainer of RSwitch --- and developer of my own (for personal use) macOS, iOS, watchOS, iPadOS and tvOS apps --- I need the full Apple Xcode install around (more R-focused macOS folk can get away with just the command-line tools being installed). As an Apple Developer who insanely\u2026","rel":"","context":"In "macOS"","block_context":{"text":"macOS","link":"https:\/\/rud.is\/b\/category\/macos\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":10991,"url":"https:\/\/rud.is\/b\/2018\/07\/06\/visualizing-macos-app-usage\/","url_meta":{"origin":12537,"position":2},"title":"Visualizing macOS App Usage with a Little Help from osqueryr & mactheknife","author":"hrbrmstr","date":"2018-07-06","format":false,"excerpt":"Both my osqueryr and macthekinfe packages have had a few updates and I wanted to put together a fun example (it being Friday, and all) for what you can do with them. All my packages are now on GitHub and GitLab and I'll be maintaining them on both so I\u2026","rel":"","context":"In "R"","block_context":{"text":"R","link":"https:\/\/rud.is\/b\/category\/r\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2018\/07\/app-lod-tree-1.png?fit=1200%2C1197&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2018\/07\/app-lod-tree-1.png?fit=1200%2C1197&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2018\/07\/app-lod-tree-1.png?fit=1200%2C1197&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2018\/07\/app-lod-tree-1.png?fit=1200%2C1197&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2018\/07\/app-lod-tree-1.png?fit=1200%2C1197&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":12990,"url":"https:\/\/rud.is\/b\/2021\/03\/13\/retrieve-process-run-time-architecture-on-apple-silicon-macs-on-the-command-line-with-archinfo\/","url_meta":{"origin":12537,"position":3},"title":"Retrieve Process Run-time Architecture on Apple Silicon Macs On The Command Line with `archinfo`","author":"hrbrmstr","date":"2021-03-13","format":false,"excerpt":"Apple M1\/Apple Silicon\/arm64 macOS can run x86_64 programs via Rosetta and most M1 systems currently (~March 2021) very likely run a mix of x86_64 and arm64 processes. Activity Monitor can show the architecture: but command line tools such as ps and top do not due to Apple hiding the details\u2026","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/rud.is\/b\/category\/apple\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":13365,"url":"https:\/\/rud.is\/b\/2022\/03\/13\/a-zsh-helper-script-for-updating-macos-rstudio-daily-electron-quarto-cli-installs\/","url_meta":{"origin":12537,"position":4},"title":"A zsh Helper Script For Updating macOS RStudio Daily Electron + Quarto CLI Installs","author":"hrbrmstr","date":"2022-03-13","format":false,"excerpt":"RStudio's macOS Electron build is coming along quite nicely and is blazing fast on Apple Silicon. I like to install the dailies, well, daily!; and, of late, RStudio and Quarto are joined at the hip. As a result, I regularly found myself having to manually update Quarto CLI right after\u2026","rel":"","context":"In "macOS"","block_context":{"text":"macOS","link":"https:\/\/rud.is\/b\/category\/macos\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":12497,"url":"https:\/\/rud.is\/b\/2019\/09\/14\/rswitch-1-5-0-release-now-also-corrals-rstudio-server-connections\/","url_meta":{"origin":12537,"position":5},"title":"RSwitch 1.5.0 Release Now Also Corrals RStudio Server Connections","author":"hrbrmstr","date":"2019-09-14","format":false,"excerpt":"RSwitch is a macOS menubar application that works on macOS 10.14+ and provides handy shortcuts for developing with R on macOS. Version 1.5.0 brings a reorganized menu system and the ability to manage and make connections to RStudio Server instances. Here's a quick peek at the new setup: All books,\u2026","rel":"","context":"In "Apple"","block_context":{"text":"Apple","link":"https:\/\/rud.is\/b\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/09\/rswitch-1.5.0-rstudio-server.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/09\/rswitch-1.5.0-rstudio-server.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/09\/rswitch-1.5.0-rstudio-server.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2019\/09\/rswitch-1.5.0-rstudio-server.png?resize=700%2C400 2x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/12537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=12537"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/12537\/revisions"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=12537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=12537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=12537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}