0

Today I got a popup message in my iPad2 (jailbroken using absinthe) that it have 0 free space.

Using ssh, I check the size of folders in the iPad and found out an interesting file that took 4.1G space and keep growing.

The file is /private/var/keybags/backup_keys_cache.db

The owner is root user and wheel group. Curious, I rename the file into backup_keys_cache.db.orig. I do ls again and found that the file got created again and now keep growing in size.

AbiFathirs-iPad:~ root# ls -alh /private/var/keybags/
total 4.1G
drwx------  2 root wheel  170 Feb 18 23:54 ./
drwxr-xr-x 30 root wheel 1.2K Feb 18 23:52 ../
-rw-------  1 root wheel  97K Feb 19 00:03 backup_keys_cache.db
-rw-------  1 root wheel 4.1G Feb 18 23:56 backup_keys_cache.db.orig
-rw-r--r--  1 root wheel 2.9K Feb 18 18:44 systembag.kb

I want to know if anybody else have this problems? I tried to uninstall newly installed application, from cydia and from app store, but the process that wrote to this file is still running and the file continue to grow.

I tried to install lsof, but when I run it, it crash with message Cannot allocate memory

Update Feb 19, 2012:

One of my friend suggest a temporary solution to prevent the process writing into this file. Delete/rename the original file, then create new file as symbolic link to /dev/null

cd /private/var/keybags/
mv backup_keys_cache.db backup_keys_cache.db.orig2 && ln -s /dev/null backup_keys_cache.db

Now with the file become symbolic link into the black hole, it should not hog down the storage space. I still have the original 4.1GB file saved in my laptop, and smaller file that created after the original file got renamed.

I tried to use db4.6_dump to read this file but I got this message:

DATA=END
db4.6_dump: backup_keys_cache.db: DB_VERIFY_BAD: Database verification failed

My friend suspect it could be from sniffing tools, but he also curious why the file could be that big.

Update Feb 28, 2012

Today I found out that the application (malware?) might have ability to learn and find a way to always write the backup_keys_cache.db file. It could detect and delete the softlink that I made into /dev/null with the same name. I tried to delete the file, make a directory with the same name, but today the directory have been renamed and the backup_keys_cache.db file now had 1.9M size.

If the file not got into 4.1GB, I might not aware about it's existence. I need to know if any other iPad 2 users had the same problem. Please check your device and see if you had the file in there or not.

Improve this question
5
  • Hi Daniel, any reason for editing my question and remove specific update date? Do YOU have solution for my problems? Care to share it as answer?
    – Donny Kurnia
    Feb 28, 2012 at 12:43
  • I can't speak for @Daniel, but you are able to rollback the changes if you do not like them. However, to me it looks as though the extra update would best be supplied either as a comment, or an answer. Constantly updating the question makes it hard to follow a flow of answers where there are different ones that reply to the question in various stages of edit. Not necessarily an issue here as you have no answers yet, but that would be my guess. Please don't be offended by edits, it's not like he is getting any reward for making the changes, just trying to improve the quality.
    – stuffe
    Feb 28, 2012 at 16:08
  • Actually, I read the edit wrong, the above applies still as a general rule tho. The removal of a link to another question within a question is because the additional info with the new question does not need to be in the question itself - look on the right hand side, you will see that the question has been linked using proper SE tools, rather than an updated question that may be missed. The removal od sectional titles "Update 12Feb" etc is to clean the question up, these details are irrelevant and do not enable more effective answering of your question, but make it harder to digest the issue.
    – stuffe
    Feb 28, 2012 at 16:11
  • I edited your question to fix unclear grammar. While I was making verb tenses consistent, I also cleared out date headers, as that is not the general style convention on this site. I also deleted the reference to a second question, as individual questions generally stand on their own, and separate topics fall in separate threads. No, I don't have a solution to your problem; if I did, I'd have posted it as an answer -- that's what we're here for. Since I didn't have an answer, I tried to improve your question to increase the likelihood that someone else would be able to help you.
    – Daniel ♦
    Feb 28, 2012 at 16:13
  • Hi Daniel & stuffle, I apologize if my comments above seems inappropriate. Maybe because I feel paranoid of the malware possibilities. I also have edited few question in stackoverflow and I think it's best to leave few short notes in the edit summary.
    – Donny Kurnia
    Feb 29, 2012 at 6:20

2 Answers 2

Reset to default
0

After examining syslog in my iPad, I found 2 rows that contain the word key

Feb 28 22:25:21 AbiFathirs-iPad backupd[50473] <Warning>: INFO: Refreshed cache in 4.852 s

Feb 28 22:25:21 AbiFathirs-iPad backupd[50473] <Warning>: INFO: Exporting keychain

I check backupd executable in the process list and found it here:

# ps A|grep backupd
50803   ??  Ss     0:00.43 /System/Library/PrivateFrameworks/MobileBackup.framework/backupd

After examining the executable file content using strings in my ubuntu laptop, I found out that this might be an iCloud backup application.

So I try to disable iCloud in control panel, and new the file /private/var/keybags/backup_keys_cache.db no longer appear.

I don't know why the cache file could get to 4GB size last week. But at least now I knew which application that cause it.

Improve this answer
0

If you turn off iCloud it deletes the file and frees the memory

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .