Anyone know about /private/var/keybags/backup_keys_cache.db Today I got a popup message in my iPad2 (jailbroken using absinthe) that it have 0 free space.

Using ssh, I check the size of folders in the iPad and found out an interesting file that took 4.1G space and keep growing.

The file is /private/var/keybags/backup_keys_cache.db

The owner is root user and wheel group. Curious, I rename the file into backup_keys_cache.db.orig. I do ls again and found that the file got created again and now keep growing in size.

AbiFathirs-iPad:~ root# ls -alh /private/var/keybags/
total 4.1G
drwx------  2 root wheel  170 Feb 18 23:54 ./
drwxr-xr-x 30 root wheel 1.2K Feb 18 23:52 ../
-rw-------  1 root wheel  97K Feb 19 00:03 backup_keys_cache.db
-rw-------  1 root wheel 4.1G Feb 18 23:56 backup_keys_cache.db.orig
-rw-r--r--  1 root wheel 2.9K Feb 18 18:44 systembag.kb


I want to know if anybody else have this problems? I tried to uninstall newly installed application, from cydia and from app store, but the process that wrote to this file is still running and the file continue to grow.

I tried to install lsof, but when I run it, it crash with message Cannot allocate memory

Update Feb 19, 2012:

One of my friend suggest a temporary solution to prevent the process writing into this file. Delete/rename the original file, then create new file as symbolic link to /dev/null

cd /private/var/keybags/
mv backup_keys_cache.db backup_keys_cache.db.orig2 &amp;&amp; ln -s /dev/null backup_keys_cache.db


Now with the file become symbolic link into the black hole, it should not hog down the storage space. I still have the original 4.1GB file saved in my laptop, and smaller file that created after the original file got renamed.

I tried to use db4.6_dump to read this file but I got this message:

DATA=END
db4.6_dump: backup_keys_cache.db: DB_VERIFY_BAD: Database verification failed


My friend suspect it could be from sniffing tools, but he also curious why the file could be that big.

Update Feb 28, 2012

Today I found out that the application (malware?) might have ability to learn and find a way to always write the backup_keys_cache.db file. It could detect and delete the softlink that I made into /dev/null with the same name. I tried to delete the file, make a directory with the same name, but today the directory have been renamed and the backup_keys_cache.db file now had 1.9M size.

If the file not got into 4.1GB, I might not aware about it's existence. I need to know if any other iPad 2 users had the same problem. Please check your device and see if you had the file in there or not.
After examining syslog in my iPad, I found 2 rows that contain the word key

Feb 28 22:25:21 AbiFathirs-iPad backupd[50473] &lt;Warning&gt;: INFO: Refreshed cache in 4.852 s

Feb 28 22:25:21 AbiFathirs-iPad backupd[50473] &lt;Warning&gt;: INFO: Exporting keychain


I check backupd executable in the process list and found it here:

# ps A|grep backupd
50803   ??  Ss     0:00.43 /System/Library/PrivateFrameworks/MobileBackup.framework/backupd


After examining the executable file content using strings in my ubuntu laptop, I found out that this might be an iCloud backup application.

So I try to disable iCloud in control panel, and new the file /private/var/keybags/backup_keys_cache.db no longer appear.

I don't know why the cache file could get to 4GB size last week. But at least now I knew which application that cause it.