segb-core — panic-free reader for Apple SEGB container files.

What is SEGB?

SEGB is Apple's container format used by the Biome subsystem on macOS and iOS to store user-activity streams. Each Biome stream (e.g. ~/Library/Biome/streams/restricted/App.MenuItem/local) is a SEGB file whose records carry a state flag, one or two timestamps, and a raw protobuf payload.

Two variants exist:

Quick start

use std::fs::File;
use std::io::BufReader;
use segb::{read_segb, SegbRecord, menuitem::decode_app_menu_item};

let f = File::open("/path/to/App.MenuItem/local").unwrap();
let mut r = BufReader::new(f);
for record in read_segb(&mut r).unwrap() {
    let item = decode_app_menu_item(record.payload(), record.timestamp_unix()).unwrap();
    println!("{:?} → {:?}", item.application, item.menu_item);
}

References

• ccl-segb (Alex Caithness / CCL Solutions): https://github.com/cclgroupltd/ccl-segb
• Unit 42 research (Palo Alto Networks, 2026): https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/
• forensicnomicon catalog entry macos_biome_app_menuitem