Today I got a popup message in my iPad2 (jailbroken using absinthe) that it have 0 free space.
Using ssh, I check the size of folders in the iPad and found out an interesting file that took 4.1G space and keep growing.
The file is
The owner is
root user and
wheel group. Curious, I rename the file into
backup_keys_cache.db.orig. I do
ls again and found that the file got created again and now keep growing in size.
AbiFathirs-iPad:~ root# ls -alh /private/var/keybags/ total 4.1G drwx------ 2 root wheel 170 Feb 18 23:54 ./ drwxr-xr-x 30 root wheel 1.2K Feb 18 23:52 ../ -rw------- 1 root wheel 97K Feb 19 00:03 backup_keys_cache.db -rw------- 1 root wheel 4.1G Feb 18 23:56 backup_keys_cache.db.orig -rw-r--r-- 1 root wheel 2.9K Feb 18 18:44 systembag.kb
I want to know if anybody else have this problems? I tried to uninstall newly installed application, from cydia and from app store, but the process that wrote to this file is still running and the file continue to grow.
I tried to install
lsof, but when I run it, it crash with message
Cannot allocate memory
Update Feb 19, 2012:
One of my friend suggest a temporary solution to prevent the process writing into this file. Delete/rename the original file, then create new file as symbolic link to
cd /private/var/keybags/ mv backup_keys_cache.db backup_keys_cache.db.orig2 && ln -s /dev/null backup_keys_cache.db
Now with the file become symbolic link into the black hole, it should not hog down the storage space. I still have the original 4.1GB file saved in my laptop, and smaller file that created after the original file got renamed.
I tried to use
db4.6_dump to read this file but I got this message:
DATA=END db4.6_dump: backup_keys_cache.db: DB_VERIFY_BAD: Database verification failed
My friend suspect it could be from sniffing tools, but he also curious why the file could be that big.
Update Feb 28, 2012
Today I found out that the application (malware?) might have ability to learn and find a way to always write the backup_keys_cache.db file. It could detect and delete the softlink that I made into /dev/null with the same name. I tried to delete the file, make a directory with the same name, but today the directory have been renamed and the backup_keys_cache.db file now had 1.9M size.
If the file not got into 4.1GB, I might not aware about it's existence. I need to know if any other iPad 2 users had the same problem. Please check your device and see if you had the file in there or not.