diskarbitrationd

executablemacOS451.3 KBx86_64, arm64

System service daemon — manages network configuration, security credentials, and device telemetry

Handles network configuration and reachability monitoring through system-level APIs. Manages access to Keychain, certificates, and code signing operations for credential storage and validation. Communicates directly with hardware and drivers for low-level system control. Submits diagnostic telemetry and analytics to Apple endpoints. Maintains private storage for configuration and state data. Exposes 5 XPC services to enable controlled access from other system components and applications.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 451.3 KB
UUID: 9D593A1F-045C-3FBB-BAE2-4730A830A37A
Analyzed: 2026-04-09T09:47:33Z
CDHash: e2693ff8609ef61922e212284e3a404efb0c1c519bfe835e220ac0e8542d58f7

Capabilities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

StoragePrivate storage area access

com.apple.private.security.storage-exempt.heritable [object Object]

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks13

UserFS(weak)LiveFS(weak)libutil.dylib CoreAnalytics(weak)FSKit(weak)libbsm.0.dylib SystemConfiguration Foundation CoreFoundation IOKit Security libobjc.A.dylib libSystem.B.dylib

Entitlements10

com.apple.private.LiveFS.connectiontrue

com.apple.private.allow-external-storagetrue

com.apple.private.coreservices.canmaplsdatabasetrue

com.apple.private.fskit.module-runnertrue

com.apple.private.security.disk-device-accesstrue

com.apple.private.security.storage-exempt.heritabletrue

com.apple.private.vfs.revoke-mounted-devicetrue

com.apple.private.xpc.launchd.ios-system-sessionfalse

com.apple.rootless.datavault.metadatatrue

com.apple.security.iokit-user-client-class AppleAPFSUserClient

Interesting Strings

Bundle IDs(37)

#com.apple.private.LiveFS.connection %com.apple.private.fskit.module-runner %com.apple.rootless.datavault.metadata (com.apple.private.allow-external-storage *com.apple.security.iokit-user-client-class

File Paths(20)

/Library/Filesystems /Library/Preferences/SystemConfiguration/autodiskmount.plist /Library/Preferences/SystemConfiguration/com.apple.DiskArbitration.diskarbitrationd.plist /System/Library/Filesystems /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

telemetry(3)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics _AnalyticsSendEventLazy com.apple.diskarbitrationd.telemetry

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(6)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

1

Hardware

1

IPC

0

Analytics

1

Security

1

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

3

File Paths

20

Bundle IDs

37

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codec6c55c38289d7300524db206ae0d6023dcbfbd4974a4f2fe57e4366a4d09bb4f

Imports33c663d8f62533d63353c2f3e0bfa413bc6d948fa5e3e300951b06af2805397d

Frameworkseeec7aaa33a8c71a9908d260bed241187ad2e9d4588e565025e0c14b43c4a4a8

Classesd124f97c028ef6fe6a2f86a46fb1fe575a0eca6d4fbbcb3bb5714e4d75e49abe

Entitlements7c58513706a94b873ebb2836ce3d4a9c1840aef31114bea552d3a586264dd100

Symbolsa9fa9297fe05b3bb448b2a6ceb0a494256976aa6fa98640f0e87f7db67e7a860

Static Libraries0 / 532 functions identified

Functions(532)

0x100001100sub_100001100

0x100001144sub_100001144

0x1000011b0sub_1000011b0

0x1000014d0sub_1000014d0

0x100001524sub_100001524

0x100001578sub_100001578

0x100001674sub_100001674

0x1000016a4sub_1000016a4

0x100001720sub_100001720

0x100001764sub_100001764

0x1000017b8sub_1000017b8

0x10000180csub_10000180c

0x10000183csub_10000183c

0x100001920sub_100001920

0x100001a28sub_100001a28

0x100001accsub_100001acc

0x100001b14sub_100001b14

0x100001b5csub_100001b5c

0x100001b68sub_100001b68

0x100001bd4sub_100001bd4

Imports426 symbols from 11 dylibs

libSystem.B.dylib213 CoreFoundation128 IOKit33 libobjc.A.dylib19 SystemConfiguration11

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

IOMFB_bics_daemon

InternetSharing

endpointsecurityd

applessdstatistics