Screen Time on iOS 15 to 27: Mostly Empty Usage Tables and Counts That Change Without the Write-Ahead Log

Screen Time, the iOS feature that reports and limits device use, keeps its state in a Core Data store, RMAdminStore-Local.sqlite, which forensic guidance and public parsers read for app usage. That guidance dates from iOS 12, and we found no re-measurement on current releases. We read 17 iPhone full file system stores, from iOS 15.6 to 26.6.2, with plain SQL, once with the database's write-ahead log applied and once from the main file alone, and compared the counts with eight parser artifacts we wrote for the store: 136 of 136 counts agreed. The usage tables held rows on only 4 of the 17 stores and were empty on most iOS 26 stores whose Screen Time flag is on. Reading the database without its -wal file changed at least one count on 14 of the 17 stores, in both directions; one store showed 441 usage blocks instead of 78. What the stores do keep is configuration, an installed-app list and Core Data persistent history, whose deletion tombstones hold identifiers that the live list no longer holds. On these stores, empty usage tables support no statement about use, and every reading should state whether the log was applied.