home > A computer > IMazing is a new word in file system management for iPhone and iPad. IExplorer - dig into the files of iOS devices with the convenience The iphone file system

IMazing is a new word in file system management for iPhone and iPad. IExplorer - dig into the files of iOS devices with the convenience The iphone file system

When working with a jailbroken iOS device, problems can arise that can only be solved by modifying the files. And for this you need to know the basic structure of the file system, understand where everything is and what files are responsible for what, where programs and tweaks are installed and how they interact with each other. We will talk about all this.

Main directories and files

iOS - UNIX-like operating system and uses a file system structure very similar to UNIX and OS X. The "folder" here is referred to as the "directory", and the file system "grows" from the root /. The ~ sign denotes the user's home directory. In normal mode it is /var/mobile/ , in root mode it is /var/root . Some directories are standard for UNIX systems. This is /boot - here in UNIX the system kernel and RAM disk are located (in iOS, the kernel is located in the /System/Library/Caches/com.apple.kernelcaches/kernelcache directory), /etc - settings for low-level services, /tmp - temporary files, / bin - commands to run using the terminal, / mnt - mount point for external file systems (flash drives, etc. are connected here).

The directories of most interest to us are /System , /Library and /var . It is here that the operating system itself (the first directory), system data (the second), application settings and their data (the third) are stored.

Standard (pre-installed) applications are in the /Applications directory. Here are located executable files Cydia, Zeusmos and some other .app programs that require a jailbreak to install. There are a lot more files here than icons on the iOS desktop, as there are also some internal services highlighted as individual applications(Facebook service built into iOS, Print Center and some others). On a non-jailbroken device, this directory is updated only when the entire firmware is updated, however, some applications from Cydia are installed in it, like the Cydia store itself.

Downloaded from App Store applications are stored in /var/mobile/Containers/Bundle/Application , each in its own subdirectory. The names of these subdirectories are encoded, and in order to understand what kind of application it is, you need to go into the directory and go to the next one. Apps not installed from the App Store are also usually found here. Each application is assigned a subdirectory in the /var/mobile/Containers/Data/Application directory, inside which the application stores its settings and data created during operation. We will consider its structure in more detail later.

System updates are downloaded to the /var/mobile/MobileSoftwareUpdate directory. They can be removed via standard application"Settings". All wallpapers are stored in /Library/Wallpaper , and system sounds- in /System/Library/Audio/UISounds , music and video from the computer - in /var/mobile/Media/iTunes_Control/Music .

We should also mention the /var/mobile/Library/caches/com.saurik.Cydia directory. This is where tweak deb packages are stored until Springboard is restarted. If you need to download the tweak to your computer, you can get it from here. Also, during installation, tweaks often create additional directories where they store their own data. Usually such directories are mentioned in the documentation of tweaks.

Programs for working with device FS directly

There are several programs for working with the FS of a device after a jailbreak.

iTools is a program for Mac and Windows that allows you to add and remove files in the file system. This is where its functions end. An advantage for many can be the bookmarks bar to the left of the file browser window, where you can find programs, tweaks, ringtones or device wallpapers.
iFunBox - has much more features. With it, you can create directories, delete, rename files or export them to a PC. It is surprising only the lack of a search for the FS.
Filza File Manager - allows you to view file metadata right on the device, rename, move, delete them, open many types of files. There is a built-in folder search and simultaneous work with several files.
iFile - superior to Filza in many ways file manager. Some features open only after payment full version program, but the interface in the utility is more convenient and understandable.

Of course, work with file system You can also use the terminal. There is full support for UNIX commands, so file system management will be very fast and convenient.

Application catalogs and sandboxes

Continued available to members only

Option 1. Join the "site" community to read all the materials on the site

Membership in the community during the specified period will give you access to ALL Hacker materials, increase your personal cumulative discount and allow you to accumulate a professional Xakep Score rating!

There are a lot of programs that make life easier for owners of Apple technology. Many people love iTunes and cannot imagine life without it, but the "native apple" program is not able to satisfy all the needs of an advanced user. Today we will tell you about the most popular file manager for iOS devices - iFunBox.

The free iFunBox app (link at the end of the article) is designed to run from a computer running macOS or Windows and is an advanced file manager for iOS devices. This program will fully reveal its potential only with hacked devices (on which it is made), but it also finds its application for ordinary gadgets, for example, for that.

iFunBox does not take up much disk space. After starting the program with the device connected, you can see something like this:

The main features of the iFunBox program

Access to applications installed from the App Store;
Viewing, uploading and deleting photos and videos from the device gallery (to fully upload photos to the device, you need to clean the cache folder and reboot the device or have a tweak installed from - which is necessary);
Access to a folder with standard iOS wallpapers;
Ability to copy downloaded applications (*.ipa files) to the device;
Ability to copy downloaded tweaks and programs from Cydia (*.deb files) to the device and install them by rebooting the device;
Access to a folder with standard iOS ringtones (read how to create a ringtone);
Access to purchased and downloaded books from iBooks;
Access to voice recorder recordings;
Access to folders with all applications on the device (both installed and standard) for various manipulations;
Access to a "clean" file system (for advanced users);
and much more

The program supports creating shortcuts to frequently used folders. This is very convenient for those who often dig into the bowels of iOS, replace files, clear the cache, install and remove jailbreak tweaks. You can also create shortcuts to folders where you need to copy files so that they get into desired applications, for example, video in

File managers quite a lot has already been divorced for the iPhone. Among this motley assortment, there are both not fully translated Chinese crafts, as well as fancy copies with dozens of different buttons. We will leave their large comparative review for later, but for now let's pay attention to the DiskAid program. It has two obvious advantages - ease of learning and use + cross-platform (new versions of the program are simultaneously released for Macs and PCs).

Let's not talk about the need for file manager for iPhone - for owners of jailbroken devices, its absence negates all the advantages of a jail. But DiskAid is not a simple file manager. Its developers managed to do the impossible - it seems that their program in life would not be able to get approval from Apple, but the App Store officially skipped the client for viewing the files that you uploaded to the device.

All that is required of you is to install the program, connect your iPhone to your computer and launch DiskAid. You will see this window:

The most important thing in it is the lower left corner. If your iPhone is jailbroken, you can select from the dropdown list Root Folder- this will take you to the root of the iPhone's file system.

Paragraph Media Folder is the /var/mobile/Media folder. It is notable for the fact that it stores music from the iPod, podcasts, voice notes and much more useful things.

Paragraph DiskAid Folder- just there is a folder that will be visible to you from the FileAid program on the iPhone.

The purpose of the buttons on the top toolbar is clear even without English captions. Let's talk about the useful button bookmarks. Let's say you regularly need to look into the documents folder of one of the programs installed on the iPhone. Traveling through its bowels, you will be surprised to find that in the folder /var/mobile/Applications there are not the programs themselves with human-readable names, but creepy-looking type identifiers 3A686EC7-17D6…. Already inside these folders are the programs themselves. So, so that you do not have to remember where everything is hidden, it is enough to go to desired folder, open the bookmarks panel and click on the plus sign there.

Everything is great, of course, but there is a big minus: DiskAid does not support access rights. This can seriously complicate your (and your iPhone's) life if you're dealing with system files. Therefore, we recommend using the program in conjunction with from Cydia.

About the younger brother of DiskAid - a program File Aid nothing much to say. Her story is sad - before she really allowed you to upload files via DiskAid to a special folder on your iPhone from one computer and access them on another. When you connect an iPhone to a PC computer, you see its photo album in the form of a special folder in Explorer. FileAid allowed us to see another folder there - in which all the uploaded files were located.

But recently, App Store censors finally realized their oversight and demanded that FileAid cut the ability to transfer files via USB. Now she has changed her name to and is no different from dozens of similar viewers. Files are now proposed to be uploaded via Wi-Fi.

It was easy to install the original iPod and access it as a USB stick. This can be done with the iPhone as well, although there are different approaches depending on the type of data you want to work with.

In this article, we will look at different approaches and they are summarized below:

In fact, it is impossible to work with data other than camera files and data from selected applications on a non-jailbroken device. In this article, we'll look at both approaches.

PTP: access photos, videos and camera data as a disk mount

iOS automatically presents modern devices like cameras when connected via USB. This uses the Picture Transfer Protocol (PTP), which is a rather limited system that allows you to copy photos back and forth. You will probably recognize the DCIM folders where the photos usually appear.

PTP has a number of disadvantages: most obviously, you cannot access files except from the camera. And PTP does not support features such as renaming or modifying files or folders: instead, it must delete and recreate them in order to make changes. It's slow.

Access photos and app data via AFC via iTunes

Access application data via USB with FUSE

FUSE is a system that allows users to mount drives on their computers under Windows control or Mac without having to make admin-level changes to their systems. FUSE stands for "User Space File System" and is available in various forms on most platforms. FUSE itself is an abstraction layer because it is not a technology that communicates directly with a device or data source: this usually takes a different approach. When iPhone setup as a drive, FUSE will communicate with the iPhone using a different protocol: SSH, AFC/AFC2, PTP, or WebDAV. Windows often uses the popular user-mode Dokan file system, while osxfuse is popular on macOS.

From the user's point of view, since FUSE normalizes the way device data is represented, it usually doesn't matter which protocol is responsible for the mount.

Using FUSE for macOS

Let's demonstrate this approach on macOS and how to mount the device. For this to work, you'll need to install the free Homebrew package manager and become familiar with using the macOS terminal.

First of all, let's find the UDID of your device. This can be done with free version, using the lsusb command, or using the ioreg -p IOUSB -l -w 0 command. Launch iPhone Backup Extractor while your device is connected, select your device and choose the Info tab. You will see the UDID shown in the "Hardware IDs" section:

$ brew tap homebrew/cask $ brew cask install osxfuse ==> Caveats To install and/or use osxfuse you may need to enable their kernel extension in System Preferences → Security & Privacy → General For more information refer to vendor documentation or the Apple Technical Note: https://developer.apple.com/library/content/technotes/tn2459/_index.html You must reboot for the installation of osxfuse to take effect.

And let's install ifuse , which is code that can interact with iOS devices via FUSE:

$ brew install ifuse

With ifuse installed, you can mount your iPhone or iPad using the UDID we got earlier:

$ mkdir ~/iphone $ ifuse ~/iphone --udid 000000000000000000000000

This will install your iPhone as a drive on your computer. If you want to go ahead and dig into more data, this superuser post is pretty handy, and similarly this post is about using the usbmuxd tool.

Troubleshooting Errors You May Encounter

ifuse might complain: Invalid device UDID specified, length needs to be 40 characters . Starting with the iPhone X, Apple changed UDID s to use 24 bytes and a dash (-) instead of the old 40-byte format.

If you are not Failed to connect to lockdownd service on the device. try again. If it still fails try rebooting your device. make sure your device is connected and does not display the "Trust this computer" dialog box. You will need to approve it first. If after that you get ERROR: Device 000000000000000000000000 returned unhandled error code -13 you need to disconnect and reconnect the device.

It's worth making sure there are no other apps running on your PC or Mac that might be trying to connect to your iOS device.

If you only intend to mount one iOS device, you can simply run ifuse ~/iphone .

Need to use pre-release usbmuxd?

usbmuxd isn't frequently updated, so occasionally when a new version of iOS is released, it lacks support. To fix that, you can install the latest development version of it as below:

brew unlink usbmuxd brew install --HEAD usbmuxd brew unlink libimobiledevice brew install --HEAD libimobiledevice brew cask uninstall osxfuse brew cask install osxfuse idevicepair

Access app data via USB with FUSE on a jailbroken device

The instructions are exactly the same as above. With a jailbroken device, you will immediately see more data. Neatly, huh?

Using Filza WebDAV Server to Access iOS Root File

On a hacked iOS device it is possible to install a file manager application named Filza via Cydia. In Fileza settings you can enable WebDAV server mode. This provides a fairly simple interface for other devices to access your iOS device, albeit highly insecure. WebDAV is a very general mechanism for working with web data, and there are many clients that can access it, including the web interface built into Filza. Connect to your device via web browser and you will see the interface. Easily.

Using AFC2 to access iOS files via USB

What is AFC2?

AFC2 can be installed from Cydia and once installed, the AFC client will be able to view the device in its entirety.

Other Methods to Access All Data on Jailbroken Devices

Prior to the release of iOS 8, there were several Cydia plug-ins for jailbroken devices that, when plugged in, would make the iPhone present itself as a USB flash drive. Alas, they are no longer supported in modern versions of iOS.

Recover deleted files from a connected iOS device

If you can connect your iPhone or iPad as a drive, you might think that you can recover deleted files by manipulating the file system directly on the jailbroken device. Unfortunately, you cannot recover files from iPhone this way because the file system is encrypted. Even if you could find the data bits, you couldn't decipher them. Each file has its own encryption key, and these keys are discarded when deleted.

The Apple iOS Security Guide briefly describes this on page 17 in the "architecture overview":

Each time a file is created in the data partition, Data Protection creates a new 256-bit key (the "per file" key) and passes it to the AES hardware engine, which uses the key to encrypt the file when it is written to flash in AES-XTS mode . Devices with SoC A7, S2, or S3 use AES-CBC. The initialization vector is computed with a block offset into the file, encrypted with the SHA-1 hash of the key for each file.

Mounting might work well for accessing existing files but it doesn't help much for recovery. For this you will need backup copy iTunes or iCloud, iCloud-synced data, or a forensic image of the device before the data was deleted.

Bonus: Mounting a Windows Computer from Your iPhone or iPad

iOS 13 introduced SMB support for iOS. This allows users to get remote access to the disks Windows computers. Here's how it works:

Find the IP address of your Windows computer. The ipconfig command should tell you this.

On your iOS device, open the Apple Files app, click Connect to Server. Type smb:// followed by your PC's IP address. Then select "Registered User" and enter the name and password of your account Windows.

After that your Windows disk should appear on the iOS device.