Review iPhone by using Basic Unix Commands

On this topic, I would like to review the disk partitions and filesystem of iPhone. The objective is the fact that I want to know how iPhone organized the filesystem. I also introduce some interesting system files and configurable ones. All commands I used here are just basic Unix commands.  I expect that this topic will be the good point to review many things in the future. I am just an iPhone rookie (just bought and reviewed iPhone for only 5 days), so you can give me a piece of advice if you found that the content I put here is incorrect or not good enough.


  • This topic may be improved and updated later to cover more basic issues about iPhone.
  • If you have an iPhone and want to try like I did, before proceeding, you must have either Terminal (also called vt-100) or OpenSSH with a secure-shell client (SSH client) to order Unix commands. If applicable, you should know how to use a few common Unix commands (e.g., ls and cd). Moreover you should know how to use a Unix editor tool available on iPhone (e.g., vi, vim and pico). Otherwise you can use an iPhone utility program (e.g., iPhone PC Suite and iBrickr) to tranfer any files from iPhone to PC. Next you can modify them on PC. Then you transfer them back to iPhone at their orginal locations. Some SSH clients (e.g., SSH client from provide a convenient tool for transfering files like this as well.


Overview of the File Structure

I enter the basic command to show you directories from the root directory ‘/’ on iPhone.

# ls -la /
drwxrwxr-t 18 root admin 680 May 2 14:18 .
drwxrwxr-t 18 root admin 680 May 2 14:18 ..
-r–r–r– 1 root admin 400 May 2 12:45 .Install_Signature
drwxr-xr-x 39 root admin 1802 May 2 15:18 Applications
drwxrwxr-x 12 root admin 408 May 2 12:43 Library
drwxr-xr-x 3 root wheel 102 Feb 11 09:04 System
drwxr-xr-x 2 root admin 68 Mar 25 06:11 arm-apple-darwin
drwxr-xr-x 45 root wheel 1530 May 2 12:43 bin
drwxrwxr-t 2 root admin 68 Dec 12 15:39 cores
dr-xr-xr-x 3 root wheel 740 May 2 13:56 dev
lrwxr-xr-x 1 root admin 11 Feb 11 10:16 etc
lrwxr-xr-x 1 root admin 11 Feb 11 10:16 mach
drwxr-xr-x 4 root wheel 136 May 1 02:07 private
drwxr-xr-x 17 root wheel 578 May 2 12:43 sbin
lrwxr-xr-x 1 root admin 15 Feb 11 10:16 tmp -> private/var/tmp
drwxr-xr-x 8 root wheel 272 May 1 02:13 usr
lrwxr-xr-x 1 root admin 11 Feb 11 10:16 var -> private/var

From the above information, it looks like many Unix/Linux file systems. iPhone OS contains the basic directories such as bin, sbin, etc, usr, dev, and var. I will not mention the detail of such directories at here.

I tried to reviewed what stuffs inside each directory and also their some subdirectoried. For example, this is the stuffs inside /Library

# ls -la /Library
drwxrwxr-x 12 root admin 408 May 2 12:43 .
drwxrwxr-t 17 root admin 646 May 2 22:35 ..
drwxrwxrwt 2 root admin 68 Dec 12 15:39 Caches
drwxrwxr-x 3 root admin 102 May 1 02:15 Frameworks
lrwxr-xr-x 1 root admin 22 Feb 11 10:16 Keychains -> /private/var/Keychains
drwxr-xr-x 2 root wheel 68 Feb 11 08:57 LaunchAgents
drwxr-xr-x 5 root wheel 170 May 2 15:18 LaunchDaemons
lrwxr-xr-x 1 root admin 17 Feb 11 10:16 Logs -> /private/var/logs
drwxr-xr-x 4 root admin 170 May 2 12:44 MobileEnhancer
lrwxr-xr-x 1 root admin 24 Feb 11 10:16 Preferences -> /private/var/preferences
lrwxr-xr-x 1 root admin 22 May 2 12:43 Ringtones -> /private/var/Ringtones
drwxr-xr-x 1 root admin 14 May 1938 02:26 Wallpaper

As shown above, two interesting stuffs are Ringtones and Wallpaper. Due to their names, the former one stores ringtone files and the later one keeps wallpaper files. We could add more ringtone and wallpaper on the two directories respectively; however, we need a trick to add ringtone files. I will mention the trick on a later topic someday.

Review the Partitions

We use df to report the disk partitions and also their space usages. We add the option -h to show the human-readable format.

# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/disk0s1 300M 180M 117M 61% /
devfs 18K 18K 0B 100% /dev
/dev/disk0s2 15G 2.1G 13G 14% /private/var

The information above shows us how iPhone organises its partitions. There are 3 partitions mounting as /dev/disk0s1, devfs, and /dev/disk0s2. I will call them “system“, “device“, and “big” partitions respectively.

About the device partition, the term devfs refers to Device File System.  Actually I’m not sure the device partition is mainly used for on iPhone, you can tell me if you know. It may be used by some I/O components inside iPhone like other Unix/Linux systems.

The system partition is pointing at the root directory (or / ). It mainly keeps system files and application programs, and also wallpapers. The size of this partition is 300 MB. That is the reason why we can store a limited number of applications and even wallpapers on iPhone. Don’t worry! there is a trick to free up the space on this partition in which you can add much more ones. This trick will be presented on the later topic as soon. Currently my system partition consumes 180 MB (or 61%) and lefts 117 MB.

The big partition is actually the biggest partition of iPhone, mounting to /private/var. It contains Camera Rolls (keeps the pictures capture by the camera) , ringtone files, temporary files, directories used by applications, and many more. The big partition of my iPhone is 15 GB due to the 16 GB model. If it were the 8 GB model, this partition might be 7 GB.

As the first above section, the command ls -la / shows two symoblic links of directory (aka the folder shortcut on Windows) indicated by “l” prefix (e.g., lrwxr) and subfix by the ->  as follows 

lrwxr-xr-x 1 root admin 15 Feb 11 10:16 tmp -> private/var/tmp
lrwxr-xr-x 1 root admin 11 Feb 11 10:16 var -> private/var

Both /tmp (temporary directory) and /var have been linked under /private/var (the mont point of the big partition) so they are located on the big partition as well. Additionally /var and the mounting point /private/var are the same place. 

The ringtone files are stored at /private/var/Ringtones (also see above when you query ls -la /Library) in which it is the physical place where /Library/Ringtones has linked to (Ringtones -> /private/var/Ringtones).  Because of locating on the big partition, the ringtones could be stored more than wallpapers. One more interesting issue, I found some posts on the Web. They said that some iPhones do not use the link in which they keep ringtone files on the system partition.

The reason I shew you these symbolic links because I like to tell you that we can use symbolic links as the way to free up the system partition🙂 . OK! if you know the way to do, you can proceed now (but be careful) ; however, I will present this topic someday.

Repartitioning the iPhone Disk

There’re possibilities that we can repartition the iPhone disk. I have ever seen the information cliaming that there is a tool (WinPwn, not sure) that can repartition the disk, unfortunately, I still do not find the real manual to do that, please tell me if you know.  Additionally we also could use partition utitlity tools (e.g., Disk Utilitity of MacOSX) to do. Because I have never tried repartioning, I still don’t know how side-effects are. Don’t forget! I’ve just bought and studied iPhone for 5 days.

If we can repartition the disk without downsides, we can give much more space on the system partition. Finallly we could install more applications and add more wallpapers/ringtones without worry.

Check Disk Usage

The command du shows the disk capacity consumed by a specific file or directory.

My capacity is utilized for 2.2 GB now.

# du -hs /
2.2G /

This command shows the total disk usage on /Applications directory. Currently the directory just consumes only 21 MB.

# du -hs /Applications
21M /Applications

If we remove the option -s (means the summary), we see the capacity consumed by each subdirectory (if one exists). As shown below, /Applications/ – the application used for capturing the active screen of iPhone, consumes only 416 KB as well.

# du -h /Applications
8.0K /Applications/
8.0K /Applications/
8.0K /Applications/
8.0K /Applications/
272K /Applications/
416K /Applications/
108K /Applications/


Review some files on /etc

Many Unix/Linux systems include /etc containing many configurable files. These files usually belong to root or some programs. If we are not familiar with these files, we should not edit them. Because they may cause some problems when they have something wrong. By the way, whenever changing a configurable file, we need to signout from and login to the system again to activate the change.

/etc/passwd and /etc/master.passwd

I need to know what user accounts are available on my iPhone.

# cat /etc/passwd
nobody:*:-2:-2:Unprivileged User:/:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh

daemon:*:1:1:System Services:/var/root:/usr/bin/false
unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

As shown above, there’re only two main accounts on iPhone, root and mobile. /var/root and /var/mobile refer to  the home directory of both accounts correspondingly. I expect that most applications on iPhone run as mobile due to reviewing stuffs inside /var/mobile/Library, containing many directories owned by  mobile and named as application titles.  Otherwise, the root account performs priviledge operations e.g., installing programs and managing the system.

I need to see how each user account’s password looks like. The file /etc/master.passwd contains the master password (aka the shadow password file on Linux).

# tail -n 5 /etc/master.passwd
root:/smx7MYTQIi2M:0:0::0:0:System Administrator:/var/root:/bin/sh
mobile:/smx7MYTQIi2M:501:501::0:0:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1::0:0:System Services:/var/root:/usr/bin/false
unknown:*:99:99::0:0:Unknown User:/var/empty:/usr/bin/false

Since I surveyed on the Web, I know that the root has the key “alpine” as the password. So /smx7MYTQIi2M must be the encrypted password of the key. On my iPhone, mobile also has the same password as root’s. To confirm /smx7MYTQIi2M be the encryped version of the key alpine, I used the Perl script. To follow this command, you must install the Perl runtime on your iPhone or find other system that includes it.

# perl -e ‘ print crypt(“alpine”, “/s”), “\n”  ‘

Changing passwords

I’d ever tried to change the root’s password by the command passwd after I only bought iPhone for 2 days. You know? It made me crazy for a few hours because my iPhone was recursively crashed in which I could not fix anything. Then I performed the recovery process to restore the iPhone and reinstalled everyting again. So I recommend that you should not change any passwords even any accounts.

However if we still need to change the password for an account, I think that we could use Perl to generate the encrypted password of the plain password. Then you could replace the encrypted password for such user account on /etc/master.passwd file. This is the basic method in which many people have ever used on some Unix systems (especially FreeBSD). But I have never tried this method on my iPhone :)  


/etc/profile contains the script in which it will run whenever we start the shell. We use the command cat to see the content inside a file.

# cat /etc/profile

export PATH

if [ “${BASH-no}” != “no” ]; then
[ -r /etc/bashrc ] && . /etc/bashrc

We can edit this file whenever we need to add/change some setting. Some programs (e.g., Perl and Python) require us to change the $PATH environment variable. For example, if you need to let the global PATH know ‘/var/progs’, you could append the PATH like below



This file contains a list of hosts. It initially contains the localhost (or iPhone itself). We can add more entries to recognize more hosts but do not change the initial entries. The following command shows the initial entries.

# cat /etc/hosts localhost broadcasthost
::1 localhost

For example, I add one more entry to reconize my connecting PC, says as its IP address and PC as its alias.       localhost broadcasthost
::1             localhost   PC

I generally ping both sides of PC and iPhone to make sure that they definitely know each other. When aliasing the PC host, I can order the short command like ping PC instead of ping 192.168.106 .


This file contains network services running on iPhone. Although we could change this file, we left this file for using by any programs.

Review Users’ Homes

Let’s see the other interesting issues. I like to know what files both user accouts, mobile and root, maintain at their homes.

What mobile maintains at its home

Let me review the mobile‘s hoome first. See the following output that shows two main directories inside the mobile‘s home (/var/mobile).

# ls -l /var/mobile
-r–r–r– 1 mobile wheel 10 Dec 12 15:39 .forward
drwxr-xr-x 27 mobile wheel 1054 May 2 13:57 Library
drwxr-x— 11 mobile wheel 544 May 2 14:21 Media

/var/mobile/Library contains the directories used by application on iPhone as partly presented as follows 

drwxr-xr-x 4 mobile wheel 272 May 2 15:18 Installer
drwx—— 2 mobile wheel 136 May 1 02:39 Keyboard
drwxrwxrwx 2 root wheel 136 May 2 17:47 Labyrinth
-rw-r–r– 1 mobile wheel 45553 May 2 15:32 LockBackground.jpg
drwxr-xr-x 3 root wheel 204 May 1 02:14 Lockdown
drwx—— 3 mobile wheel 170 May 2 19:27 Mail
drwxr-xr-x 2 mobile wheel 102 May 2 17:41 Maps
drwxr-xr-x 5 mobile wheel 204 May 2 01:24 MobileFinder
drwxr-xr-x 2 mobile wheel 68 May 2 15:22 MobileStudio
drwxr-xr-x 2 mobile wheel 136 May 2 15:12 MobileToDoList
drwxr-xr-x 2 mobile wheel 136 May 2 17:51 MxTube

Most directories are named as application titles. Some of them belong to root. I give you some instances of these directories only owned by mobile as follows

  • /var/mobile/Library/AddressBook keeps our contact list or the address book(e.g., phone numbers, emails, addresses) stored on the file named AddressBook.sqlitedb
  • /var/mobile/Library/SMS contains SMS messages kept on the file named sms.db.
  • /var/mobile/Library/Calendar managed the database of calendar events kept on the file named Calendar.sqlitedb.
  • /var/mobile/Library/Notes contains written notes (kept on notes.db) done by the software called Notes.
  • /var/mobile/Library/Installer maintains files used during the software installation process. I may review more about this directory someday.

I realize that most official Apple’s iPhone applications use SQLite as the database engine, due to reviewing the header of some *.db and *.sqlitedb files. If we know the format of SQLite, we could implement a program to retrieve data kept inside these files.

/var/mobile/Media contains folders to keep media files such as music and video mainly played by iPod (a program like iTunes but we call it like an iPod player) and Camera Rolls (like a datastore to keep images taken by the camera of iPhone).

How iPod (of iPhone) Manages Media Files

We know that iPhone includes iPod as a software to play movie and music files. This is my first time when I have an iPod player and and first Apple phone in the single unified gadget. I would like to know how iPod manages the files. After guessing the name of directory, I reviewed /var/mobile/Media/iTunes_Control where is the place to keep all media files brought to iPod.

# ls /var/mobile/Media/iTunes_Control
Artwork         Music           Ringtones       iTunes

I am interesting only two subdirectries, Music  and iTunes. Firstly I reviewed subdirectories (50 items) maintaind on Music. The format looks like FXX (e.g., F00, F01, F02, …, F48, F49). Inside each subdirectory keeps zero or more music files. Unfortunately, the name of a stored music file is machine-readable format such as HCHM.mp3, RLKG.mp3 and XLPS.mp3. It seems that iPod renames media files before storing. I still don’t discover how it renames them. Again! if you know the way, please let me know too.

On iTunes, there are more than 10 files. I’m interesting only one file, iTunesDB. When opening the file, I see that actually it is the database maintaining all stored media files of iPod. Although the format is hard to read, I expect that there are tools or ways to understand the format. I see that it contains a list of names of the files and music playlists. If we can reveal this format clearer and know how to manipulate the file iTunesDB, we could also implement an application like iPod / iTunes on iPhone.

Where Camara Stores Photos

Like metioned before, Camera Rolls is a datastore of images taken by the built-in camera. For iPhone, it is similar to many camaras in which the directory of images is named as DCIM ,that is, /var/mobile/Media/DCIM. On the directory, it may contain more than one subdirectories. On my iPhone, it contains only one directory 100APPLE composing of captured images. Interestingly, each image has two files, JPEG and THM. The JPEG file is the original image while the THM file is the thumbnail (or smaller version of image) that let us view many images simultaneously faster.


What root maintains at its home

Let’s see what are kept at the root‘s home /var/root/

# ls -l /var/root
-rw——- 1 root wheel 921 May 2 02:23 .bash_history
lrwxr-xr-x 1 root wheel 19 May 2 12:44 Library -> /var/mobile/Library
lrwxr-xr-x 1 root wheel 17 May 1 02:14 Media -> /var/mobile/Media

The first file .bash_history is used to store commands that we typed on the bash shell, like other Unix/Linux systems. Let’s the two directories, Library and Media. Interestingly, they are linked to mobile‘s Library and Media correspondingly. It seems root manages most things on mobile‘s home and other  places instead of its own home, however; it is general for root on many systems.

Learn as You Need

For me, there’re many things to study on iPhone. If I put many things on only this topic, I take much time to post a new topic even this one. So please come here again to check my update.  Otherwise you can review the others on iPhone filesystem by yourself. If you find some interesting issues, please let me know. Some people might say that don’t change anything on iPhone, if you are not sure to do that. You could recover your iPhone after its software was crashed, so you could modify its software as you need, but wisely and carefully, and don’t forget to backup necessary data.  Finally see you on the next topics! Bye

10 thoughts on “Review iPhone by using Basic Unix Commands

  1. Pingback:
  2. adrenaline says:

    เยี่ยมครับ เจ๋งเลย อยากรู้คำสั่ง shut down หรือไม่ก้อ halt โปรแกรม มีไหมครับ

  3. โอ้ว สุดยอดเลยครับอาจารย์
    ถ้าอย่างนี้เราจะ cross compile แล้วเอาโปรแกรมลงเองพอจะเป็นไปได้ไหมครับนี่

  4. javaboom says:

    ถึงคุณ Adrenaline ครับ คำสั่ง shutdown ให้เครื่อง poweroff เลยบน iPhone ผมยังหาไม่เจอ แต่ถ้าเป็น rebooot น่ะมีครับ ใช้คำสั่ง reboot เลยครับ
    คุณสามารถเข้าไปดูคำสั่งพื้นฐานของ Unix บน iPhone ได้ที่ /bin ครับ แต่ต้องเป็น root เท่านั้นนะครับถึงจะเรียกคำสั่ง reboot ได้ แต่ถ้าอยากจะ shutdown เครื่องจริงๆ กดปุ่ม sleep 5 วินาทีก็ได้ครับ

    สำหรับคำถามที่สองที่ถามว่ามีคำสั่ง halt โปรแกรมหรือเปล่า🙂 จริงๆผมกะจะไปเขียนใน topic หน้าๆครับ โอเคครับ ถามแล้วก็ต้องตอบครับ เราใช้คำสั่ง kill ตามด้วย pocess id (PID) ของโปรแกรม วิธีเช็ค PID ใช้ ps ครับ ใช้ ps -aux จะเห็นทุก process เลยครับ หรือใช้ top สำหรับแสดงผลคล้ายๆกับ Task manager ของ Windows (แต่ text mode) เช่น สมมติอยาก kill โปรแกรมที่ชื่อ update ถ้ากด ps -aux จะเห็นว่า update มี PID หมายเลข 24 ก็กด kill 24 ครับ เพียงเท่านี้ โปรแกรม update ก็หายไป ลองเช็คโดย ps -aux อีกทีก็ได้ครับว่า update ยังอยู่เปล่า

  5. javaboom says:

    ถึง Misui

    iPhone มันใช้ ARM ครับ ผมไม่ทราบว่าพวกโปรแกรมถ้าเขียนด้วย C/C++ เขาเอาไป compile กันยังไง ผมยังไม่ได้ค้นคว้าเรื่องนี้ครับ ถ้าคุณสนใจมีสมาคม developer ของ iPhone ของไทยที่ ครับ และอีกวิธีก็เป็น iPhone SDK ที่เปิดให้โหลดฟรี แต่มีข้อจำกัดในการแจกจ่าย code อย่างที่ผมพูดไว้ใน post ที่ผ่านมา

    ที่คิดได้ตอนนี้ คือเขียนโปรแกรม script (ย้ำนะ script)นึกออกแค่ Python, Ruby, Perl และ TCL ครับ หรืออย่างขำเลยก็ใช้ bash เลยครับ🙂 อันนี้ cross platform แน่ครับ และก็อีกตัวหนึ่งที่นิยมมากบน iPhone คือ jiggy ครับ เป็น JavaScript และถ้าอยากเขียน server-side ก็ใช้ PHP ครับ อันนี้เก๋าครับ เพราะ iPhone ก็มี Apache+PHP ดังนั้น เราเขียน client-server ดีๆบน iPhone ได้เลยครับ

  6. javaboom says:

    ถึงคุณ Adoubleple ใช่ครับ Apache+PHP สุดยอดครับ แต่ที่ถามว่าต่อยอดหรือเปล่า ไม่ทราบว่าหมายถึงอะไรครับ

    ให้วิเคราะห์ต่อนะ ในเนื้อหาเรื่อง Apache+PHP นะครับ กับหากเป็น Client-Server ระหว่าง PC กับ PC มันอาจจะธรรมดามากครับ แต่ถ้า PC กับ iPhone หรือ iPhone กับ iPhone มันจะทำให้เกิดโลกแบบ Ubiquteous Computing ครับ ทุกอย่างมันจะกลมกลืนไปหมดเลยครับ มันจะเกิด Market place แบบใหม่ขึ้น คิดแล้วก็ตื่นเต้นครับ เสียดายครับ ผมวางมือการ programming ไปนานแล้วครับ เพราะผมต้องทำงานด้านวิจัยงานอื่น ถ้าหากว่าใครอยากแตะ iPhone กับเทคโนต่างๆ ผมสนับสนุนครับ

  7. adoubleple says:

    ผมหมายถึง หนังสือหรือ web ที่ให้ศึกษาเพิ่มเติมของ Apacha+PHP ครับ

    ตอนนี้ยัง งงๆ กับ Concept Apache+Php on iPhone อยู่ครับบ

  8. javaboom says:

    อ่อ หนังสือ Apache + PHP มีเยอะนะครับ SE-ED ถ้าหากเรารู้ Concept ของ PHP ไม่ว่าจะบน Windows หรือ Linux ใดๆ ก็เขียนบน iPhone ได้แน่นอนครับ เพราะมันไม่ได้ต่างกันครับ อาจจะต่างกันแค่การ config ครับ ผมวางมือด้าน programming ไปหลายปีแล้วครับ แต่ถ้าจะให้แนะนำคือต้องศึกษา PHP บน Windows ก็ได้ แล้วค่อยย้ายไป iPhone ครับ

  9. JinGjOe says:

    ผมต้องอ่านแต่บทความที่เป็นภาษาอังกฤษอีกแล้วหรือนี่แต่ไม่เป็นไรผมจะพยามครับ ว่าแต่อยากได้iPhone จัง รักษาสุขภาพด้วยครับ

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s