-1

OR, how to identify type of file if file fails.

Apple took away the ability to copy Voice Memos from iPhone/iPad, so I went to copy them from the backups. in the process, I found (apparently) 206 DOS executables in the backups for our four devices:

WGroleau@MBP Backup % cd ~/Library/Application\ Support/MobileSync/Backup
WGroleau@MBP Backup % for DIR in */*; do
for> ls $DIR | while read FILE; do
for pipe while> file $DIR/$FILE
for pipe while> done
for> done | grep DOS | wc
     206     969   23052
WGroleau@MBP Backup % for DIR in */*; do
ls $DIR | while read FILE; do
file $DIR/$FILE
done
done | grep DOS | head -5
82573a47f0a7b4620a1fc329c82d491f757061be/01/01517218144e305b8b2c106e15a6d8c509aba424: DOS executable (COM)
82573a47f0a7b4620a1fc329c82d491f757061be/04/0443be5ce51f5a301d9550bf33fba30a853018b5: DOS executable (COM)
82573a47f0a7b4620a1fc329c82d491f757061be/04/046e86e4d02071edbff719985af4dd46229baeee: COM executable for DOS
82573a47f0a7b4620a1fc329c82d491f757061be/06/068cad52bad02939797677eaa77f5c7968d70118: DOS executable (COM)
82573a47f0a7b4620a1fc329c82d491f757061be/06/06e0b47ffe010ecea71c5cf9f2f3fd259b4c417d: DOS executable (COM)
WGroleau@MBP Backup %

If file has mis-identified them, is there any way to correctly identify them? What might be in 206 different files that causes file to identify all of them as .COM (but in two different ways)?

In older versions of macOS, the original file name could be determined using SQLite¹ in the backup.  But that is obfuscated and/or encrypted² in Ventura.  There are a lot of plist files in the backup.  Maybe the original name is hidden in one of them. But most are binary, so it would take a heck of a long time to find it if it is there.

¹https://apple.stackexchange.com/a/429490/65467

²https://apple.stackexchange.com/a/456963/65467

Improve this question
6
  • What is the specific path to these files?
    – nohillside ♦
    Mar 14 at 14:10
  • See first line of the Terminal capture.
    – WGroleau
    Mar 14 at 16:27
  • That's just the backup directory, you afterwards go 2 or 3 levels deeper with for DIR in */*. What is the value of $DIR for these files?
    – nohillside ♦
    Mar 14 at 16:37
  • PS: You actually should be able to run find ~/Library/Application\ Support/MobileSync/Backup -type f -exec file {} \; | grep DOS to get that output.
    – nohillside ♦
    Mar 14 at 16:42
  • The backup format is for IOS is: top level, a GUID for which device; next level, the first two hex digits of the third level filenames and an SQLite DB; third level, backups of IOS files with 41-hex digits for each file name. I added footnotes to the question for more info. Your suggested command is similar to what I actually did. But mine also told me how many there were (commands I didn't show told me they were there).
    – WGroleau
    Mar 14 at 16:48

1 Answer 1

Reset to default
2

You have no identified the exact nature of the files that you have found - so the reason why is of course only something that we can offer guesses about.

However, I'm fairly sure that what you're seeing is false positives. These are not DOS executables - you have not found DOS executables.

You're using the file program to identify file formats. It works by having a list (named magic) of various "patterns" that it uses to guess the format of the input files.

Most file formats, and certainly most modern file formats, are easily identifiable via what is known as "magic" values. Essentially these file formats have fixed values placed at fixed positions within the file to make them easily identifiable. For example a modern SQLite database file starts with the text "SQLite format 3", making it very easy to identify.

In general, modern file formats are built up of magic values, headers and payload data. Headers are often used to describe the payload that follows (or precedes) the header. For example stating it's format, encoding, etc.

However, the very oldest of file formats - such as DOS .COM files in particular - have none of these things. There's no magic value, there's no headers. It's just data without any encapsulation at all.

This makes it very hard to generate a pattern for .COM files that do not generate false positives.

So to sum up - most probably you do not have .COM executables on your iPhone.

Improve this answer
4
  • If file has misidentified them, is there any other way to identify them? What might be in 206 different files that causes file to identify all of them as .COM (but in two different ways)?
    – WGroleau
    Mar 14 at 13:48
  • @WGroleau You can look into /usr/share/file/magic/msdos to see which byte patterns are used to identify DOS files. These are byte sequences which can be basically in any file.
    – nohillside ♦
    Mar 14 at 14:17
  • So, from examining the first few bytes of each, they likely are not COM files. A separate question will have to be composed for further information. :-)
    – WGroleau
    Mar 14 at 16:53
  • @WGroleau They for sure are not COM files. But that was clear from the start.
    – nohillside ♦
    Mar 14 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .