Crate segb 

segb-core — panic-free reader for Apple SEGB container files.

What is SEGB?

SEGB is Apple’s container format used by the Biome subsystem on macOS and iOS to store user-activity streams. Each Biome stream (e.g. ~/Library/Biome/streams/restricted/App.MenuItem/local) is a SEGB file whose records carry a state flag, one or two timestamps, and a raw protobuf payload.

Two variants exist:

Variant	Magic location	Header size	Alignment
SEGB v1	Last 4 bytes of header (offset 52–55)	56 bytes	8 bytes
SEGB v2	First 4 bytes (offset 0–3)	32 bytes	4 bytes

Quick start

use std::fs::File;
use std::io::BufReader;
use segb::{read_segb, SegbRecord, menuitem::decode_app_menu_item};

let f = File::open("/path/to/App.MenuItem/local").unwrap();
let mut r = BufReader::new(f);
for record in read_segb(&mut r).unwrap() {
    let item = decode_app_menu_item(record.payload(), record.timestamp_unix()).unwrap();
    println!("{:?} → {:?}", item.application, item.menu_item);
}

References

• ccl-segb (Alex Caithness / CCL Solutions): https://github.com/cclgroupltd/ccl-segb
• Unit 42 research (Palo Alto Networks, 2026): https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/
• forensicnomicon catalog entry macos_biome_app_menuitem

Re-exports

pub use common::EntryState;

pub use error::Result;

pub use error::SegbError;

pub use segb1::SegbV1Record;

pub use segb2::SegbV2Record;

Modules

common

Shared types used by both SEGB v1 and v2 decoders.

error

Error type for the SEGB reader.

menuitem

App.MenuItem protobuf payload decoder.

proto

Minimal protobuf field walker — varint + length-delimited types only.

segb1

SEGB v1 reader.

segb2

SEGB v2 reader.

Enums

SegbRecord

A version-neutral SEGB record, produced by read_segb.

Functions

read_segb

Detect the SEGB variant in r and read all records.