Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Aggregated disk writes

i have found the text below in iPhone analytics data. What does it mean please?

{"app_name":"aggregated","app_version":"","bug_type":"145","timestamp":"2020-02-06 08:20:33.14 +0300","os_version":"iPhone OS 13.3.1 (17D50)","incident_id":"34880E87-9A67-4A16-A17A-94D0369275CF","slice_uuid":"B722CBE6-961A-3300-80E4-2CC18CCFC143","build_version":"","is_first_party":true,"share_with_app_devs":true,"name":"aggregated"}

Date/Time: 2020-02-05 21:01:20 +0300

End time: 2020-02-06 08:20:32 +0300

OS Version: iPhone OS 13.3.1 (Build 17D50)

Architecture: arm64e

Report Version: 29

Incident Identifier: 34880E87-9A67-4A16-A17A-94D0369275CF


Data Source: Microstackshots

Shared Cache: 0x1a4e8000 A77981DC-1632-354B-978B-380DC657D1E6

Shared Cache: 0x24988000 A77981DC-1632-354B-978B-380DC657D1E6


Command: aggregated

Path: /System/Library/PrivateFrameworks/AggregateDictionary.framework/Support/aggregated

Version: ??? (???)

PID: 1811


Event: disk writes

Action taken: none

Writes: 1073.75 MB of file backed memory dirtied over 40752 seconds (26.35 KB per second average), exceeding limit of 12.43 KB per second over 86400 seconds

Writes limit: 1073.74 MB

Limit duration: 86400s

Writes caused: 1073.75 MB

Writes duration: 40752s

Duration: 40752.35s

Duration Sampled: 40679.60s

Steps: 263 ( (10.49 MB/step))


Hardware model: iPhone12,1

Active cpus: 6

iPhone 11, iOS 13

Posted on Feb 7, 2020 5:50 PM

Reply
Question marked as Best reply

Posted on May 1, 2020 3:27 AM

Let me preface all of this by saying something I've wanted to say for over a year. You people on these forums who give snide, sarcastic responses to others who come here for help (as if they're paranoid or wanting a problem) should be ashamed of yourselves. This stuff is REAL. Yes, there are some paranoid people out there, but when you've had your entire electronic world taken over and you discover that people have been doing things you didn't even know was possible it tends to make you a little paranoid. 

Your situation sounds exactly like my scenario-except I know who is behind my issue. The capabilities that can be enabled by a malicious developer are insane. And the lack of regulation with enterprise software is maddening. When the wrong people get a hold of it (like the culprit behind my issue, who works in IT and used a copy from his work)...they have complete, hidden control over your devices. It doesn't matter how many times you wipe your devices-it is designed to persist. The person "helping" me installed enterprise software on my laptop without my knowledge. He created a hidden administrator profile and my entire system was a remote desktop controlled by him. There are menu items I am blocked from seeing, some settings I'm unable to change and even though my phone wasn't paired with the laptop (I didn't even have itunes on the computer) everything was syncing to it. He has been able to control my home network, despite my purchasing a new router. I spent MULTIPLE hours/days getting help from Microsoft and Apple- but I never got help from anyone skilled enough to fully (and permanently) remove the management tools. Microsoft remoted into my system and uncovered and deleted the files and secret administrator profile but they didn't go far enough. The stalker actually remoted into my system and brought up some sort of chat window and taunted me, saying it would always come back because it was in the registry. I've been told by an IT person at my work that I'll have to get new devices (laptop and phone) and abandon my Microsoft and Apple ID's to be free of it. The software companies make most of their money from enterprise/group policy clients. Every business out there uses management software-which I understand. But it is infuriating to have lost control of my entire electronic existence on my personal devices that I paid good money for. Software I purchased and basically my whole life.  All pictures of my children, documents, the email address I've always used (for every account, including my banking and utilities) are no longer in my control. I never would have believed it would be so difficult to get help for something like this. I now realize I never will. I never gave anyone my passwords and have always been hypervigilant about protecting my network. I've always kept my software and security up to date.

Similar questions

95 replies

May 29, 2020 1:53 PM in response to DARKG8R

UPDATE : Important recollection during 13.4 when my Apple Trusted certificates changed and the Nvram OTA after - In March, my location somehow was fixed and correctly showed Boston, MA. It stayed that way for a few weeks until the 13.4 update, when it changed to a different State again. This is so major, I can't believe I didn't post it. But I Support did do a screenshare and enhanced log. They CHANGED my iphone IMEI !!!! This was of the 2-3 logs that generated after an 'unknown' restore completed. I recall this in thinking back a few weeks ago when I asked cell co. to redo the sim. She said would but nothing ever happened.


As of today, I am completely unable to change my location from the State it is in. I received a manadarin call today and two Stacks logs generated immediately during when the call came in.


Bottom line: Someone fixed my location and the criminals needed and were able to access my phone remotely to send a rogue update that must have restored my device using someone else's system which is why IMEI is wrong. Looking in General all is good but certain if my device was checked forensically, IMEI won't match. And they also have access to my icloud because since 13.0 end Dec, my backups were turned off or deleted after Apple restore. Including last month. There are also both Provisioning amd MDM. Multiple of each. Added note. No ios updates should be coming from carrier since phone purchased from Apple Store. See short video proving I am no longer able to correct or use location in Safari. Taken today


Edited to insert correct screen video


May 29, 2020 2:10 PM in response to Community User

Mine hasn’t ever been green. When I go anywhere on Apple I get directed through idmsa.apple.com. I have never paid for a developer account but yet I can access any developer site I want. I got kicked out of their community because I was complaining about all this stuff and I guess I broke the non disclosure agreement. But I can still get there. That’s why I think the developers/hackers have something to do with it. They ain’t angels!

May 29, 2020 5:10 PM in response to Cr21h

Another thing I notice. Today is Friday May 29. It occurred last night. Reinstalled H--ulu from appstore last night. Twice.

1) Size of app doesn't match what is posted in appstore but version says correct. The app generated a crash log Thread 4 "AVaudiosession notify thread" amongst other thin it says.


2) G---oogl--e Ch--romeC---a--st is installed on my iphone??? see pic. Why would this be installed if I downloaded app from Apple appstore onto iphone? And why is not all arm64e? Some is just arm64.

Apr 28, 2020 9:46 PM in response to DARKG8R

Check your analytics for ips ca synced and backboardd with 2 d’s you my friend are live multiUnicast with no control at that point every crash has details of what is being done. Aggregated crashes I believe a disk rewrites. Means something’s changing and written over/replaced. These hackers can use your device to communicate and connect to other devices there is no limit to your device capability.

Apr 28, 2020 11:18 PM in response to DARKG8R

Interesting that I found this post here. I just posted earlier regarding Certs validation. My Certs changed recently. And, i'm going through the same thing. I have a disk writes log in my phone and generated last night.

problem started at the end of September beginning of October. After every Apple update someone is remotely restoring my device. Effectively downgrading my device. I've contacted Apple multiple times since I also noticed managed configuration and remote management. This was listed numerous times and logs. logs have changed now, then not the standard logs I've always had.

I contacted support again after the update because I noticed an OTA nvram wipe as 'stale'.This after an update. The interesting things is what I viewed in the log. And why I noticed the Trust Certificates date changed. there were numerous exceptions and regarding Certs it was saying no name and to pull a name from a specific file I won't mention here. I am 110% certain, it blacklisted com...apple..os..software...update... or something along that layout. Ditto for Apple's own Certs. it also did things to hardware which I do not know. But since I contacted support and they screen shared with me they should certainly have that particular log question. all the times I've contacted them in the last months of all pertained to managed configuration and remote management. Also, that it appeared a system restore was taking place after each Apple update. I was never more certain than this last update a few weeks ago. A white screen with black letters said restore completed it was hidden behind the black login screen with the Apple.


contacted support again today regarding MDM and remote management because of the disk writes I saw. as always I am told it's not possible unless it says profile. Also it is not possible to do a restore unless it is I that's doing it. While I beg to differ, hey, they are the experts. It's been a trust factor in the Mojo I feel for Apple. But I have three devices that I'm not feeling confident about at the moment.


I do believe developer certificates are being used. I wonder if it Is coming from my cable company since they also sell the same products and offer the same service for said products. My home network and phone are using excess data.


This is definitely at least for myself not happening for the benefit of Apple or reputation. Consider black listing them from their own products, inserting rogue Certs, downgrading ios and other Apple product systems. Plus, from what I've seen in the last four or five updates since end of September they appear to know the schedule of these updates that are not publicly shared. Because something funky always occurs prior to the update release. but with the big transformations I saw the other week I'm not sure that will be necessary at all anymore.


Hopefully Apple sees this here and can fix it. because, as of today, I'm simply told the MDM cannot happen without a profile and remote restores not possible. I have received no answers regarding nvram, certs and the screenshare either. advisers tell me they have no record of any of it. Including today I was told there was no record of screenshare or data all the data and proof of mdm, I submitted to the gigabyte site. He wants me to send more data saying I have to prove it as if I already haven't. I'm done. I'd like it fixed now.

May 1, 2020 12:15 PM in response to Bugshappen

It seems your biggest problem is your Windows system, the solution there is dump your Windows PC.


As to your iPhone there is Apple Software that allows configuration of an iPhone, it is used by companies that issue iDevices. But there is no way hide the configuration and your IT person would have to get physical access to your iPhone for an hour to do this.


In the meantime you can easily clear any such configuration software by putting your iPhone in DFU mode and completely wipe everything off the iPhone. Then if you want to go all in create a new Apple ID when you restore the iPhone and do not restore it from your backup. And do this on someone else's computer with iTunes. That will solve your iPhone problem as long as you use a strong password for the Apple ID.


Apple charging $99 for developers has nothing to do with your problem, that is how people write applications and sell them. And the FBI is currently still asking Congress for Apple to be required to include a back door because they can't get in. They had to pay $1 million dollars just to get in to an old phone that did not have the security enclave.


Since you know who this person is I take it you have already reported the person to the local police department.

May 1, 2020 1:19 PM in response to deggie

It's bigger than that. He had access to the phone. The "helper" is my ex-fiance. He volunteered to pick up my iphone from the apple store for me after I had the screen repaired...and after I'd requested that apple reset it for me because the battery was draining very rapidly. He told me he took it to his place and plugged it into his computer to give it the firmware from directly from itunes, rather than over the air, because it's better 🙄. The phone was also a gift from him. After I'd already had it for a year he admitted that he had previously jailbroken it, and said the jailbreak is automatically removed with updates. He knows serial number, IMEI,etc. I already put the phone in DFU mode and did a secure restore. He has my phone number set up to get text and OTA updates. When the glitch showed up every time I restarted the phone I'd get error messages saying a text was unable to send-but the weren't related to any texts I sent. Recently I reset the phone and got something I never had before. It said,"Your SIM sent a message."

May 1, 2020 1:22 PM in response to Bugshappen

So you gave him access to actually jailbreak it. You did half of what you needed to do, the other half is going to your cell provider and getting a new SIM and a new phone number. No magic hacking was needed in your case but by restoring it from DFU and changing your SIM and number you will have shut him out from that.

May 1, 2020 1:27 PM in response to Bugshappen

Yes, I have not only read it but also used it and it does indeed result in the phone displaying information that it is a managed device and does show up in profiles. But no one can hack into your iPhone and put it on your iPhone. You would have to give them the iPhone along with the passcode, Apple ID and password. There is nothing sinister about it.

May 1, 2020 1:29 PM in response to deggie

He did that years ago, when we were still together. He has not had any access to the phone in over two years. I did a secure restore. He has the phone connected to a cloud service and his configuration settings load back onto it every time it is reset. Even when I create a new apple id. I don't think I'll ever be rid of everything until I buy a new phone and computer.

May 1, 2020 1:49 PM in response to deggie

Can you please stop with the argumentative, pat responses? I know what a legitimately managed configuration profile looks like on an iphone. I have a work iphone, which is managed with a visible configuration profile. I can also tell you I've had the iphone through work, in a government job, for 7 years. It has ALWAYS been managed, but a configuration profile or indication that it was managed never showed on the device until my work changed systems (Switched to a Google platform) about 6 months ago. There are multiple ways managed configurations can be implemented. If you're not aware of them maybe it's a different certification than you have. I'd rather not engage in a debate with you. This is a forum for people to help each other-not chastise or challenge people for not being as knowledgable as you. Thanks for the advice.


He loaded the firmware onto it before he gave it to me.

Aggregated disk writes

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.