Hi all, I have a question what could be this
<string>wake</string>
<key>scheduledby</key>
<string>PersConn-apsd-coh.apple.com</string>
<key>time</key>
is it a notification? of what?
Thanks
Hi nannib,
It would probably help if you inform us what file you obtained it from, as well as the device.
It looks like part of a Property list dictionary. If that's the case, you're missing a key at the top and a value (probably a <real> or <date> tag) at the bottom.
Hi all,
I'm interested to know what is this
PersConn-apsd-coh.apple.com
is it a daemon? What runs it?
I have the time too (not published here), but I'm reading it from a binary dump and I currently can't mount the filesystem….someone can help me?
bye
Unfortunately, I think Logan hit the nail on the head…it might help if you could provide some context.
I does look as if it might have come from a plist of some kind, but from where? You said a "binary dump"…is this from a memory dump on a Windows system (Apple products such as QuickTime and iTunes install a Scheduled Task which is also in XML format)? If so, which version? Is it from an iDevice? Is it an image? Is it from a memory dump?
it is from a chip-off binary dump of an IPod Touch, it was retrieved by a strings search. )
Hi all, I have a question what could be this
<string>wake</string>
<key>scheduledby</key>
<string>PersConn-apsd-coh.apple.com</string>
<key>time</key>is it a notification? of what?
Thanks
the namespace suggests that its an apple process (i.e. not a third party )
playing acronym bingo I've come up with….
Persistent Connection
Apple Push Service Daemon
COH, I don't know. Google has failed me.
APSD is an Apple daemon responsible for synchronization. Since you specified it's from an iOS device, that's probably part of a system configuration file. (It could be part of an application configuration, a state file, or a log, but those are less likely.) It's certainly an XML Plist. So your carved-out bit is off by a bit – plists go key, then value.
If I had to gin up a plausible explanation (besides asking for more of the file and its path), I'd guess that it's the setting for a periodically-scheduled system wake event to allow the device to do synchronization (i.e., get new data).
Why can't you access the filesystem? If you can find the offset for the start of the filesystem, SleuthKit can handle iOS's HFSX.
Google did not failed you.
You gave up too soon.
Search for "PersConn-apsd" . . .
I can't mount, for now, because it's difficult to get the right data combination to recover the right order for building the file system, this happens when you make a data dump directly from the memory nand chips…. (
Thanks