search

AmnestyTech / investigations

Indicators from Amnesty International's investigations
https://amnesty.tech
1.55k stars 174 forks source link

Isolated instances of com.apple.CrashReporter.plist #8

Closed joshhopkins closed 3 years ago

joshhopkins commented 3 years ago

I'm assuming instances of com.apple.CrashReporter.plist in isolation isn't something to be too concerned about (using mtv-project and pegasus.stix2 indicators). Is it worth highlighting this in the output?

2013-11-24 07:45:56.000000,Manifest,M--B,Library/Preferences/com.apple.CrashReporter.plist - HomeDomain
2019-08-12 18:21:19.000000,Manifest,--C-,Library/Preferences/com.apple.CrashReporter.plist - HomeDomain
cormacrelf commented 3 years ago

I have this as well, it is a bplist file which looks like this when you convert to XML (plutil -convert xml1 80/80ef37a6dc6ae1caeffb16149342bd959a139c4f) gives a pretty mundane result.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>ShouldSubmit</key>
    <false/>
</dict>
</plist>

Metadata:

    {
        "fileID": "80ef37a6dc6ae1caeffb16149342bd959a139c4f",
        "domain": "HomeDomain",
        "relativePath": "Library/Preferences/com.apple.CrashReporter.plist",
        "flags": 1,
        "created": "2014-02-05 18:16:54.000000",
        "modified": "2014-02-05 18:16:54.000000",
        "statusChanged": "2020-04-19 02:04:41.000000",
        "mode": "0o100644",
        "owner": 501,
        "size": 60
    },
Xenderblade commented 3 years ago

Same found also. What to expect?

AlexandreGohier commented 3 years ago

Same for me, slightly different dates:

    {
        "fileID": "80ef37a6dc6ae1caeffb16149342bd959a139c4f",
        "domain": "HomeDomain",
        "relativePath": "Library/Preferences/com.apple.CrashReporter.plist",
        "flags": 1,
        "created": "2014-02-12 06:20:53.000000",
        "modified": "2014-02-12 06:20:53.000000",
        "statusChanged": "2020-03-12 13:48:00.000000",
        "mode": "0o100644",
        "owner": 501,
        "size": 60
    }

This is the timeline around the creation date:

2014-02-12 06:20:48.000000 | Manifest | M--B | Library/Preferences/com.apple.iapd.plist - HomeDomain
2014-02-12 06:20:48.000000 | Manifest | M--B | Library/ConfigurationProfiles/LockdownParameters.plist - SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles
2014-02-12 06:20:51.000000 | Manifest | M--B | Library/ConfigurationProfiles/MCDataMigration.plist - SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles
2014-02-12 06:20:52.000000 | Manifest | M--B | Library/Preferences/com.apple.certui.plist - HomeDomain
2014-02-12 06:20:52.000000 | Manifest | M--B | Library/Maps/ReportAProblem/Directions - AppDomain-com.apple.Maps
2014-02-12 06:20:53.000000 | Manifest | M--B | Library/Preferences/com.apple.CrashReporter.plist - HomeDomain
2014-02-12 06:21:04.000000 | Manifest | M--B | Library/Preferences/com.apple.apsd.launchd - HomeDomain
2014-02-12 06:21:07.000000 | Manifest | M--B | Media/PhotoData/assetUUIDForPath.plist - CameraRollDomain

And this is the timeline around the modification date (many events with the same timestamp):

2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.SMSBBPlugin.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.webapp
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.routine.classaoc.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.itunescloud.plist - AppDomain-com.apple.datadetectors.DDActionsService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.control-center.BluetoothModule.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mediaaccessibility.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.Music.StoreFlowExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MailAccount-ExtProperties.plist - AppDomain-com.apple.mobilemail
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.webapp.plist - AppDomain-com.apple.webapp
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.idsremoteurlconnection.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.powerlogd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainPlugin-com.apple.Music.StoreFlowExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.imessage.bag.plist - AppDomain-com.apple.InCallService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MobileCoreServices - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/SpringBoard/LockoutStateJournal.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Home.group.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.Music
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mt.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.mobilemail
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.lockscreen.shared.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.DuetExpertCenter.QueryPredictionExpert.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.control-center.MuteModule.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.apsd.launchd - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.iTunesStore - AppDomain-com.apple.ios.StoreKitUIService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.facetime.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SystemConfiguration/com.apple.mobilegestalt.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.videos.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Maps/FailedSearches.mapsdata - AppDomain-com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | M-C- | - HomeKitDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.CoreText.plist - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/SMS/Recents - MediaDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Accessibility/ckAssetFiles - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.com.apple.notes
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.WirelessRadioManager.debug.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.WebSheet
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.idscredentials.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/DataAccess/IMAP-xxx@mail.REDACTED.com - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.WebSheet.plist - AppDomain-com.apple.WebSheet
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.mobilemail
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.springboard.plist - AppDomain-com.apple.AppStore
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.timed.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.icloud.findmydeviced.postwipe.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.itunescloudd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.InCallService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.SOS.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Music.StoreFlowExtension.plist - AppDomainPlugin-com.apple.Music.StoreFlowExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.smsrelay.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.thermalmonitor.mitigationsUI.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.webapp
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.health.sync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.siri.proxy.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.accountssync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.datamigrator.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.MailCompositionService
2020-03-12 13:48:00.000000 | Manifest | M-C- | - TonesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit - AppDomain-com.apple.AppStore
2020-03-12 13:48:00.000000 | Manifest | M-C- | - AppDomainGroup-group.is.workflow.shortcuts
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.preferences.network.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/play_activity.sqlitedb - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/.ClassKit - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/1473063906 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | com.apple.networkextension.control.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobilenotes.Notes.NotesDataCollector.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.iCloudDriveApp.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ondemandd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Shortcuts.cloudkit_sync - AppDomainGroup-group.is.workflow.shortcuts
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Calendar/Notifications.Calendar.TriggeredEvent.TimeToLeaveRefresh - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit/Databases - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.EscrowSecurityAlert.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.itunescloud.plist - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MobileAddressBook.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/E21A0B51C469820EEE3A26E9F83F7C05 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/.ClassKit - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.datadetectors.DDActionsService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.handwriting.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.timesync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.softwareupdateservicesd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.iosdiagnostics.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.medialibraryd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/updates.sqlitedb - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.remotemanagementd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit - AppDomain-com.apple.mobilemail
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MultitouchSupport.crashReporter.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.preferences.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.videos-preferences.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.location.wifitilesync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.corerecents.recentsd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.CoreDuet.QueuedDenials.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | Library/Maps/ReportAProblem - AppDomain-com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.iTunesStore - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | M-C- | - AppDomainGroup-group.com.apple.FileProvider.LocalStorage
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/BDSUbiquityIdentityToken.plist - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.subservices.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.medialibrary.plist - AppDomain-com.apple.AppStore
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.siri.phrasespotter.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/SMS - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Safari.SandboxBroker.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Photo-Booth.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Accessibility.SwitchControl.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.adtracking.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.launchservices.applinkssettings.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.is.workflow.my.app
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomain-com.apple.WebSheet
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/swcd.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.datadetectors.DDActionsService
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents - AppDomainGroup-group.com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.itunescloud.plist - AppDomain-com.apple.tv
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Maps/ReportAProblem/Directions - AppDomain-com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.imdpersistence.IMDPersistenceAgent.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.quicklook.quicklookd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobilestoresettings.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.medialibrary.plist - AppDomain-com.apple.ios.StoreKitUIService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.voicetrigger.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/829F32C70BE182ED8776B26C8A930FD9 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | M-C- | - KeyboardDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.lookup.shared.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.OTACrashCopier.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.AppStore
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Accessibility.TouchAccommodations.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/DataAccess/var - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mail.composition.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/870181888 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.messaging.expire.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.coreduet.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.proxiedcrashcopier.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mt.launchDelay.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/SafariCloudHistoryPushAgent.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/mediaremoted.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PrototypeTools.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Maps/History.mapsdata - AppDomain-com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.continuity.activity.public.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SystemConfiguration/com.apple.captive.probe.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/VoiceTrigger/SAT - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Documents - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.newscore.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Duet.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.iapd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobiletimer.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.companionproxy.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SystemConfiguration/VPN-net.openvpn.OpenVPN-Connect.vpnplugin.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/group.com.apple.weather.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.datadetectors.DDActionsService.plist - AppDomain-com.apple.datadetectors.DDActionsService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.pushproxy.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/Wishlists - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SystemConfiguration/VPN-net.juniper.sslvpn.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.messages.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.facetime.sortmapping.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/com.apple.itunescloudd.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.NanoMusicSync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Accessibility/TTY - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.Music
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobile.SyncMigrator.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.ios.StoreKitUIService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mt.lastLaunch.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.AdSheetPhone.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.timezonesync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.location.motion.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.WebSheet.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | - MediaDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainPlugin-com.apple.ContactsUI.ContactViewViewService
2020-03-12 13:48:00.000000 | Manifest | M--- | locationd - HealthDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.preferences.datetime.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.dataaccess.launchd - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | rules.data - AppDomainGroup-group.com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/com.apple.itunesstored.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Music.ScriptingLocalStorage.plist - AppDomain-com.apple.Music
2020-03-12 13:48:00.000000 | Manifest | M-C- | - AppDomainGroup-group.is.workflow.my.app
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/667911132 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/243LU875E5.groups.com.apple.podcasts.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.fileproviderd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.SharedWebCredentials.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/bookassetd.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.com.apple.weather
2020-03-12 13:48:00.000000 | Manifest | --C- | SharingExtensionWriteLock - AppDomainGroup-group.com.apple.notes
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.able.internal.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Safari.Support.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MapsSupport.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/iTunesMetadata - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.WebSheet
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/itunesstored2.sqlitedb.migrated-wal - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/1118575552 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/com.apple.MobileSMS.settings - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mediaartworkd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.accessibility.controlcenter.hearingdevices.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.fignero.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.health.general.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.location.usage.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.ios.StoreKitUIService
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/com.apple.app-analytics.books-bag.db - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Shortcuts.realm.lock - AppDomainGroup-group.is.workflow.shortcuts
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ImageCaptureFramework.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.homesharing.plist - AppDomain-com.apple.AppStore
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.routine.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MobileBluetooth.debug.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.messagesbadgecontroller.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/itunesstored_private.sqlitedb.bad - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.AOSNotification.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/ckkeyrolld.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.gamecenter.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | Library/MobileBluetooth - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.iTunesStore - AppDomainPlugin-com.apple.Music.StoreFlowExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.imessage.bag.plist - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/${PRODUCT_NAME}.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/itunesstored2.sqlitedb.migrated-shm - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/620352552 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | M-C- | - CameraRollDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobilenotes.SharingExtension.plist - AppDomain-com.apple.mobilenotes
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.springboard.plist - AppDomain-com.apple.ios.StoreKitUIService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobile.installation.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MobileSMS.firstLock.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | com.evernote.evernote-sdk-ios.plist - AppDomainGroup-group.is.workflow.my.app
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.WebUI.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SystemConfiguration/com.apple.scnc-cache.plist - SystemPreferencesDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/VoiceTrigger - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | locationd/user.plist - HealthDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/BDSICloudIdentityToken.plist - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/BKJaliscoServerSource - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/UITextInputContextIdentifiers.plist - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.iTunesCloud - AppDomain-com.apple.Music
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.callhistorysync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.medialibrary.plist - AppDomain-com.apple.Music
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Application Support/CloudDocs/account.1 - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MobileStore.appremoval.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/itunesstored2.sqlitedb.bad - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/DataAccess/iCloud-REDACTED - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.PeoplePicker.plist - AppDomain-com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.location.auth.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.maps.sync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | SharingExtensionDeviceUUID - AppDomainGroup-group.com.apple.notes
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.reminders.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.fontservicesd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.watchlistd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.siricore.fides.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/BCCloudKit-iBooksSecure - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | BDSICloudIdentityToken.plist - AppDomainGroup-group.com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.coremedia.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.CrashReporter.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Maps.TransitWidget.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.maps.proxy.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/addaily.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | Library/Cookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.BatteryCenter.BatteryWidget.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobilenotes.SharingExtension.plist - AppDomainPlugin-com.apple.mobilenotes.SharingExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/BKLibraryAssetStatusController - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.sms.watch.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.WebFoundation.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | tmp - AppDomainGroup-group.com.apple.notes
2020-03-12 13:48:00.000000 | Manifest | --C- | Documents/1219117996 - AppDomain-com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit - AppDomain-com.apple.WebSheet
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.messaging.watchdog.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.siri.context.service.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/com.apple.itunesstored/itunesstored_private.sqlitedb - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.mobilenotes.SharingExtension
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | receivedsessions.data - AppDomainGroup-group.com.apple.Maps
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/kbd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.imessage.bag.plist - AppDomain-com.apple.facetime
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mediaaccessibility.public.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.siri.location.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.control-center.WiFiModule.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.akd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | smartfolders.db - AppDomainGroup-group.com.apple.DocumentManager
2020-03-12 13:48:00.000000 | Manifest | --C- | BSUITemplateBundleStorage - AppDomainGroup-group.com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.sms.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.siri.device.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Shortcuts.realm.management - AppDomainGroup-group.is.workflow.shortcuts
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.jetsam.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.airtraffic.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Maps.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.iaptransportd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M-C- | - AppDomainGroup-group.com.apple.iBooks
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.powerlog.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ubd.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.control-center.OrientationLockModule.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/com.apple.appstored.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.certui.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.mobile.user_preferences.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Safari/CloudBookmarksMigrationCoordinator - AppDomain-com.apple.mobilesafari
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.MediaRemoteUI.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/com.apple.MailCompositionService.binarycookies - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/BulletinBoard/SectionOrder.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.mobilenotes
2020-03-12 13:48:00.000000 | Manifest | M--- | Library/Preferences - AppDomain-com.apple.webapp
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.idstransfers.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Application Support/CloudDocs/pkg_extensions.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies - AppDomain-com.apple.webapp
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.Radio.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/DoNotDisturb/DB/Settings.json - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/homed/protected-metadata.config - HomeKitDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.ids.service.com.apple.private.alloy.wifi.networksync.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Application Support - AppDomain-com.apple.MobileSMS
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/WebKit - AppDomain-com.apple.MailCompositionService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.SpringBoard.plist - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | M--- | Library - AppDomainGroup-group.com.apple.reminders
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.datadetectors.DDActionsService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - AppDomain-com.apple.mobilemail
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Preferences/com.apple.facetime.bag.plist - AppDomain-com.apple.InCallService
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Cookies/com.apple.itunesstored.2.sqlitedb - HomeDomain
2020-03-12 13:48:00.000000 | Manifest | --C- | Library/Application Support - AppDomainPlugin-com.apple.ContactsUI.ContactViewViewService
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/.GlobalPreferences.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Caches/locationd/significantVisitAuth.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/MISC/MomentAnalyzerData.plist - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.medialibrary.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/Purchases - TonesDomain
2020-03-12 13:48:01.000000 | Manifest | M-C- | Media/PhotoData/Thumbnails/V2 - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/DCIM/101IMPRT - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.homesharing.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/iPhotoSandboxLibrary - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.xpc.activity.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | M-C- | com.apple.xpc.launchd - DatabaseDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/assetUUIDForPath.plist - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.UIKit.ShareUI.plist - AppDomainPlugin-com.apple.UIKit.ShareUI
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/Thumbnails/V2/PhotoStreamsData - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/protection - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.mobilenotes.SpotlightIndexExtension.plist - AppDomainPlugin-com.apple.mobilenotes.SpotlightIndexExtension
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/PhotoBulletins.plist - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | com.apple.xpc.launchd/disabled.migrated - DatabaseDomain
2020-03-12 13:48:01.000000 | Manifest | M-C- | Media/PhotoData/Metadata - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.mobilenotes.SpotlightIndexExtension
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/MISC/MomentAnalyzerServerVersionInfo.plist - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.remoted.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Application Support - AppDomainPlugin-com.apple.FileProvider.LocalStorage
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/AlbumsMetadata/C3D8AE1F-9116-4CD0-BE0E-89C4F5154AA4.albummetadata - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | M--- | Library - AppDomainPlugin-com.apple.quicklook.extension.previewUI
2020-03-12 13:48:01.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.UIKit.ShareUI
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Caches/locationd/significantVisitInterest.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Cookies - AppDomainPlugin-com.apple.quicklook.extension.previewUI
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.prdaily.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/AlbumsMetadata/7177E9A4-2F86-4F71-9345-35355A37ABD9.albummetadata - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.FileProvider.LocalStorage
2020-03-12 13:48:01.000000 | Manifest | M--- | Library - AppDomainPlugin-com.apple.FileProvider.LocalStorage
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/DCIM/100IMPRT - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.itunescloud.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.FileProvider - AppDomainPlugin-com.apple.CloudDocs.MobileDocumentsFileProvider
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.mobileipod.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.FileProvider - AppDomainPlugin-com.apple.FileProvider.LocalStorage
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/WebKit - AppDomainPlugin-com.apple.quicklook.extension.previewUI
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.DumpPanic.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/AlbumsMetadata/6675F49B-4BF6-413F-A903-F906D53F8B1E.albummetadata - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.AppStore.ProductPageExtension.plist - AppDomainPlugin-com.apple.AppStore.ProductPageExtension
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/Thumbnails/thumbnailConfiguration - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/Logs - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/Mutations - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/MISC/PXPlacesAlbumImageCached.jpg - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.jetsam.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | M-C- | Media/PhotoData/Metadata/PhotoData - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/suspendnebulad - CameraRollDomain
2020-03-12 13:48:01.000000 | Manifest | M--- | Library/Preferences - AppDomainPlugin-com.apple.AppStore.ProductPageExtension
2020-03-12 13:48:01.000000 | Manifest | --C- | Library/Preferences/com.apple.atc.plist - RootDomain
2020-03-12 13:48:01.000000 | Manifest | --C- | Media/PhotoData/Thumbnails/V2/PhotoData - CameraRollDomain
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.Preferences.indexSettingsManifests
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/lskd.rl - SysSharedContainerDomain-systemgroup.com.apple.lskdrl
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.Preferences.indexSettingsManifests
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.icloud.findmydevice.managed
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.sharedpclogging
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.ReportMemoryException
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.accessibility.AccessibilityUIServer
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.backboardd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.akd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.springboard
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.lsd.iconscache
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.metrickitd
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.icloud.searchpartyd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.icloud.searchpartyd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.WiFiAssist
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.studentd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.icloud.findmydeviced
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.ondemandresources
2020-03-12 13:48:02.000000 | Manifest | M--- | Library - SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.itunesu.shared
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.mobile.installationhelperlogs
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.icloud.findmydevice.managed
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.geod
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Library/FairPlay/iTunes_Control - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | --C- | Caches - SysSharedContainerDomain-systemgroup.com.apple.icloud.findmydevice.managed
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.akd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.apsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/dafsaData.bin - SysSharedContainerDomain-systemgroup.com.apple.nsurlstoragedresources
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.media.books.managed
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysContainerDomain-com.apple.geod
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.akd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.mobilesafari
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.geod
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Library/FairPlay/iTunes_Control/iTunes - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.media.shared.books
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.mobile.installationhelperlogs
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.backboardd
2020-03-12 13:48:02.000000 | Manifest | M--B | - SysSharedContainerDomain-systemgroup.com.apple.lskdrl
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.akd
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.cfpreferences.managed
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.icloud.findmydeviced
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.appstored
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.AssetCacheServices.diskCache
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.adid
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysSharedContainerDomain-systemgroup.com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.coreanalytics
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.akd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.icloud.findmydeviced
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.backboardd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.geod
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.osanalytics
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.apsd
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.bluetooth
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.VideoSubscriberAccount
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Media/iTunes_Control/iTunes - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.accessibility.AccessibilityUIServer
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.coreanalytics
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Library - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | --C- | - SysSharedContainerDomain-systemgroup.com.apple.mobilegestaltcache
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.sharedpclogging
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.icloud.searchpartyd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.VideoSubscriberAccount
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.apsd
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.nsurlstoragedresources
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.studentd
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.apsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.studentd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.adid
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.mobilesafari
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.icloud.searchpartyd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.metrickitd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.Preferences.indexSettingsManifests
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.studentd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.springboard
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.cfpreferences.managed
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.icloud.searchpartyd.sharedsettings
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.WiFiAssist
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.adid
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M--B | - SysContainerDomain-com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.ReportMemoryException
2020-03-12 13:48:02.000000 | Manifest | M--B | - SysSharedContainerDomain-systemgroup.com.apple.AssetCacheServices.diskCache
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Media/iTunes_Control - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.mobilesafari
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.lsd.iconscache
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.metrickitd
2020-03-12 13:48:02.000000 | Manifest | M-C- | - SysSharedContainerDomain-systemgroup.com.apple.ondemandresources
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysSharedContainerDomain-systemgroup.com.apple.media.shared.books
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.backboardd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.geod
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.springboard
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.mobilesafari
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.metrickitd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.itunesu.shared
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library/TCC - HomeDomain
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.studentd
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.accessibility.AccessibilityUIServer
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.accessibility.AccessibilityUIServer
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.lsd
2020-03-12 13:48:02.000000 | Manifest | M--B | - SysContainerDomain-com.apple.mobilesafari
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | --C- | Library/Preferences - SysContainerDomain-com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.icloud.searchpartyd.sharedsettings
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.springboard
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.Preferences.indexSettingsManifests
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Library/FairPlay - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysSharedContainerDomain-systemgroup.com.apple.bluetooth
2020-03-12 13:48:02.000000 | Manifest | M--- | Library - SysSharedContainerDomain-systemgroup.com.apple.media.books.managed
2020-03-12 13:48:02.000000 | Manifest | M--B | - SysContainerDomain-com.apple.springboard
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.apsd
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.icloud.ifccd
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.icloud.searchpartyd
2020-03-12 13:48:02.000000 | Manifest | --C- | tmp - SysContainerDomain-com.apple.backboardd
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents/Media - SysContainerDomain-com.apple.fairplayd.A2
2020-03-12 13:48:02.000000 | Manifest | M--- | - SysContainerDomain-com.apple.Preferences.indexSettingsManifests
2020-03-12 13:48:02.000000 | Manifest | M-C- | Library - SysContainerDomain-com.apple.accessibility.AccessibilityUIServer
2020-03-12 13:48:02.000000 | Manifest | --C- | Documents - SysContainerDomain-com.apple.icloud.findmydeviced
2020-03-12 13:48:03.000000 | Manifest | M-C- | Library/FrontBoard - HomeDomain
2020-03-12 13:48:03.000000 | Manifest | M-C- | Library/Database - SysSharedContainerDomain-systemgroup.com.apple.bluetooth

Any feedback is welcome to assess whether this is a false positive (or not)...

Te-k commented 3 years ago

Yes, the file com.apple.CrashReporter.plist can be linked to an attack if found with other evidences, but does not mean in itself that a phone is compromised, it can be created by legitimate processes

Te-k commented 3 years ago

Warning added, thanks, I close this discussion https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso