apfsd

executablemacOS412.8 KBx86_64, arm64

System analytics collector — gathers hardware diagnostics and sends telemetry to Apple

Collects system performance metrics, hardware diagnostics, and analytics data from the local machine. Accesses hardware information directly through kernel drivers and stores telemetry locally before submission. Communicates with Apple's analytics servers via HTTP endpoints to upload collected data. Exposes XPC services that allow other system components to contribute diagnostic information. Monitors multiple bundle identifiers and system states to compile comprehensive usage and performance profiles.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 11.0.0
SDK: 26.1.0
File Size: 412.8 KB
UUID: 673DD2A0-E2F4-3304-8A6B-C83E4941A4E9
Analyzed: 2026-04-09T09:41:24Z
CDHash: f423521bca36d0673358c1a08d16e5f7ac6da01e5b06ecb2f0629eb1b6507936

Capabilities

StoragePrivate storage area access

com.apple.private.security.storage.Cryptex [object Object]

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Frameworks11

OpenDirectory RTCReporting(weak)APFS CoreAnalytics IOKit libc++.1.dylib DiskArbitration Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements10

com.apple.private.apfs.get-graft-infotrue

com.apple.private.apfs.key-cache-evictiontrue

com.apple.private.apfs.omm.ctltrue

com.apple.private.apfs.revert-to-snapshottrue

com.apple.private.rtcreportingdtrue

com.apple.private.security.storage.Cryptextrue

com.apple.private.storage.revoke-accesstrue

com.apple.private.vfs.snapshottrue

com.apple.rootless.datavault.metadatatrue

com.apple.rootless.restricted-block-devicestrue

Interesting Strings

Bundle IDs(31)

%com.apple.private.apfs.get-graft-info %com.apple.rootless.datavault.metadata 'com.apple.private.storage.revoke-access )com.apple.private.apfs.key-cache-eviction )com.apple.private.apfs.revert-to-snapshot

File Paths(25)

/Library//Library/Application Support//Library/Caches//Library/Containers//Library/Developer/

telemetry(25)

%s:%u Err: Failed to disable rapid-aging vnodes for splitter telemetry scan: %d %s:%u Err: Failed to enable rapid-aging vnodes for splitter telemetry scan: %d %s:%u Err: Failed to send splitter telemetry scan report, err: %u %s:%u Err: Splitter telemetry scan failed with %u and %llu shared blocks found so far, sending report %s:%u Err: failed set splitter telemetry xpc activity state to %s

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

1

Hardware

1

IPC

0

Analytics

1

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

25

File Paths

25

Bundle IDs

31

IOKit Constants

0

Library Functions

1

Structural HashesSHA-256

Codeb3d2232a2010af4bf8520f607b492d649dea9a31b369d863ba6b1c93debfc862

Importsf1a86d760053f6eee71ec27b0aa8316ad48ab44459489d3020f0f445a7d869c2

Frameworks864ebce65d98792025782a148def47f1586763b3d6152d6d42fc9a6ebc81606b

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements8b5b79d185f2959faeb95d0745a2f484180ba01a062c356f46bdaf82fed6a60a

Symbolsf1a86d760053f6eee71ec27b0aa8316ad48ab44459489d3020f0f445a7d869c2

Static Libraries1 / 241 functions identified

Identified Libraries

flatbuffers 25.9.23 (1 fn)

Functions(241)

0x100000f80sub_100000f80

0x100000f88sub_100000f88

0x100000f8csub_100000f8c

0x1000010d0sub_1000010d0

0x100001174sub_100001174

0x1000011f4sub_1000011f4

0x1000012ecsub_1000012ec

0x10000138csub_10000138c

0x10000141csub_10000141c

0x100001498sub_100001498

0x1000014ecsub_1000014ec

0x100001688sub_100001688

0x1000017ecsub_1000017ec

0x1000018a8sub_1000018a8

0x100001a70sub_100001a70

0x100001c4csub_100001c4c

0x100001d34sub_100001d34

0x100001db4sub_100001db4

0x100001ee4sub_100001ee4

0x100001f84sub_100001f84

Imports326 symbols from 12 dylibs

libSystem.B.dylib114 CoreFoundation88 IOKit35 libc++.1.dylib15 DiskArbitration15

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

systemsoundserverd

applessdstatistics

appleh16camerad