├── GUI_Version └── mib_parser_GUI.py ├── README.md ├── images ├── README.md └── mib_done.PNG ├── mib_parser.sql.py └── test data ├── README.md ├── mobile_installation.log.0 └── mobile_installation.log.1 /GUI_Version/mib_parser_GUI.py: -------------------------------------------------------------------------------- 1 | #Script to extract to process the mobile instalation logs. Normalize output and import to sqlite database for report generation. 2 | import sys, os, re, sqlite3, glob 3 | import easygui as gui 4 | from pathlib import Path 5 | 6 | #initialize counters 7 | counter = 0 8 | filescounter = 0 9 | 10 | #Month to numeric with leading zero when month < 10 function 11 | #Function call: month = month_converter(month) 12 | def month_converter(month): 13 | months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'] 14 | month = months.index(month) + 1 15 | if (month < 10): 16 | month = f"{month:02d}" 17 | return month 18 | 19 | #Day with leading zero if day < 10 function 20 | #Functtion call: day = day_converter(day) 21 | def day_converter(day): 22 | day = int(day) 23 | if (day < 10): 24 | day = f"{day:02d}" 25 | return day 26 | 27 | sp = os.path.abspath(os.path.dirname(sys.argv[0])) 28 | choices = ("Ok","Cancel") 29 | 30 | buttonoption = gui.buttonbox("iOS Mobile Installation Logs Parser\nTwitter: @AlexisBrignoni\nWeb: abrignoni.com\n\nSelect the directory that contains the log files.\nReports will be generated in the following directory: "+sp+"\n\nPress OK to select the directory that contains the log files.", "iOS Mobile Installation Logs Parser", choices) 31 | 32 | if buttonoption is None: 33 | exit() 34 | if buttonoption == "Cancel": 35 | exit() 36 | 37 | #Create sqlite databases 38 | db = sqlite3.connect('mib.db') 39 | 40 | cursor = db.cursor() 41 | 42 | #Create table fileds for destroyed, installed, moved and made identifiers. 43 | 44 | cursor.execute(''' 45 | 46 | CREATE TABLE dimm(time_stamp TEXT, action TEXT, bundle_id TEXT, 47 | 48 | path TEXT) 49 | 50 | ''') 51 | 52 | db.commit() 53 | 54 | 55 | 56 | #Search for Installed applications 57 | #for filename in glob.glob('*.log*'): 58 | #file = open('mobile_installation.log.1', 'r', encoding="utf8") 59 | 60 | 61 | 62 | input_path = gui.diropenbox() 63 | if input_path is None: 64 | exit() 65 | for filename in Path(input_path).rglob('mobile_installation.log.*'): 66 | file = open(filename, 'r', encoding='utf8' ) 67 | filescounter = filescounter + 1 68 | for line in file: 69 | counter = counter+1 70 | matchObj = re.search( r"(Install Successful for)", line) #Regex for installed applications 71 | ''' Old code 72 | if matchObj: 73 | actiondesc = "Install successful" 74 | #print(actiondesc) 75 | matchObj = re.search( r"(?<=for \()(.*)(?=\))", line) #Regex for bundle id 76 | if matchObj: 77 | bundleid = matchObj.group(1) 78 | #print ("Bundle ID: ", bundleid ) 79 | ''' 80 | if matchObj: 81 | actiondesc = "Install successful" 82 | matchObj1 = re.search( r"(?<= for \(Placeholder:)(.*)(?=\))", line) #Regex for bundle id 83 | matchObj2 = re.search( r"(?<= for \(Customer:)(.*)(?=\))", line) #Regex for bundle id 84 | matchObj3 = re.search( r"(?<= for \(System:)(.*)(?=\))", line) #Regex for bundle id 85 | matchObj4 = re.search( r"(?<= for \()(.*)(?=\))", line) #Regex for bundle id 86 | if matchObj1: 87 | bundleid = matchObj1.group(1) 88 | elif matchObj2: 89 | bundleid = matchObj2.group(1) 90 | elif matchObj3: 91 | bundleid = matchObj3.group(1) 92 | elif matchObj4: 93 | bundleid = matchObj4.group(1) 94 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 95 | if matchObj: 96 | timestamp = matchObj.group(1) 97 | weekday, month, day, time, year = (str.split(timestamp)) 98 | day = day_converter(day) 99 | month = month_converter(month) 100 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 101 | #print(inserttime) 102 | #print(month) 103 | #print(day) 104 | #print(year) 105 | #print(time) 106 | #print ("Timestamp: ", timestamp) 107 | 108 | #print(inserttime, actiondesc, bundleid) 109 | 110 | #insert to database 111 | cursor = db.cursor() 112 | datainsert = (inserttime, actiondesc, bundleid, '' ,) 113 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 114 | db.commit() 115 | 116 | #print() 117 | 118 | 119 | matchObj = re.search( r"(Destroying container with identifier)", line) #Regex for destroyed containers 120 | if matchObj: 121 | actiondesc = "Destroying container" 122 | #print(actiondesc) 123 | #print("Destroyed containers:") 124 | matchObj = re.search( r"(?<=identifier )(.*)(?= at )", line) #Regex for bundle id 125 | if matchObj: 126 | bundleid = matchObj.group(1) 127 | #print ("Bundle ID: ", bundleid ) 128 | 129 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 130 | if matchObj: 131 | timestamp = matchObj.group(1) 132 | weekday, month, day, time, year = (str.split(timestamp)) 133 | day = day_converter(day) 134 | month = month_converter(month) 135 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 136 | #print(inserttime) 137 | #print(month) 138 | #print(day) 139 | #print(year) 140 | #print(time) 141 | #print ("Timestamp: ", timestamp) 142 | 143 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 144 | if matchObj: 145 | path = matchObj.group(1) 146 | #print ("Path: ", matchObj.group(1)) 147 | 148 | 149 | #print(inserttime, actiondesc, bundleid, path) 150 | 151 | #insert to database 152 | cursor = db.cursor() 153 | datainsert = (inserttime, actiondesc, bundleid, path ,) 154 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 155 | db.commit() 156 | 157 | #print() 158 | 159 | 160 | matchObj = re.search( r"(Data container for)", line) #Regex Moved data containers 161 | if matchObj: 162 | actiondesc = "Data container moved" 163 | #print(actiondesc) 164 | #print("Data container moved:") 165 | matchObj = re.search( r"(?<=for )(.*)(?= is now )", line) #Regex for bundle id 166 | if matchObj: 167 | bundleid = matchObj.group(1) 168 | #print ("Bundle ID: ", bundleid ) 169 | 170 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 171 | if matchObj: 172 | timestamp = matchObj.group(1) 173 | weekday, month, day, time, year = (str.split(timestamp)) 174 | day = day_converter(day) 175 | month = month_converter(month) 176 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 177 | #print(inserttime) 178 | #print(month) 179 | #print(day) 180 | #print(year) 181 | #print(time) 182 | #print ("Timestamp: ", timestamp) 183 | 184 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 185 | if matchObj: 186 | path = matchObj.group(1) 187 | #print ("Path: ", matchObj.group(1)) 188 | 189 | #print(inserttime, actiondesc, bundleid, path) 190 | 191 | #insert to database 192 | cursor = db.cursor() 193 | datainsert = (inserttime, actiondesc, bundleid, path ,) 194 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 195 | db.commit() 196 | 197 | #print() 198 | 199 | matchObj = re.search( r"(Made container live for)", line) #Regex for made container 200 | if matchObj: 201 | actiondesc = "Made container live" 202 | #print(actiondesc) 203 | #print("Made container:") 204 | matchObj = re.search( r"(?<=for )(.*)(?= at)", line) #Regex for bundle id 205 | if matchObj: 206 | bundleid = matchObj.group(1) 207 | #print ("Bundle ID: ", bundleid ) 208 | 209 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 210 | if matchObj: 211 | timestamp = matchObj.group(1) 212 | weekday, month, day, time, year = (str.split(timestamp)) 213 | day = day_converter(day) 214 | month = month_converter(month) 215 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 216 | #print(inserttime) 217 | #print(month) 218 | #print(day) 219 | #print(year) 220 | #print(time) 221 | #print ("Timestamp: ", timestamp) 222 | 223 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 224 | if matchObj: 225 | path = matchObj.group(1) 226 | #print ("Path: ", matchObj.group(1)) 227 | #print(inserttime, actiondesc, bundleid, path) 228 | 229 | #insert to database 230 | cursor = db.cursor() 231 | datainsert = (inserttime, actiondesc, bundleid, path ,) 232 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 233 | db.commit() 234 | 235 | matchObj = re.search( r"(Uninstalling identifier )", line) #Regex for made container 236 | if matchObj: 237 | actiondesc = "Uninstalling identifier" 238 | #print(actiondesc) 239 | #print("Uninstalling identifier") 240 | matchObj = re.search( r"(?<=Uninstalling identifier )(.*)", line) #Regex for bundle id 241 | if matchObj: 242 | bundleid = matchObj.group(1) 243 | #print ("Bundle ID: ", bundleid ) 244 | 245 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 246 | if matchObj: 247 | timestamp = matchObj.group(1) 248 | weekday, month, day, time, year = (str.split(timestamp)) 249 | day = day_converter(day) 250 | month = month_converter(month) 251 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 252 | #print(inserttime) 253 | #print(month) 254 | #print(day) 255 | #print(year) 256 | #print(time) 257 | #print ("Timestamp: ", timestamp) 258 | 259 | #insert to database 260 | cursor = db.cursor() 261 | datainsert = (inserttime, actiondesc, bundleid, '' ,) 262 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 263 | db.commit() 264 | 265 | matchObj = re.search( r"(main: Reboot detected)", line) #Regex for reboots 266 | if matchObj: 267 | actiondesc = "Reboot detected" 268 | #print(actiondesc) 269 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 270 | if matchObj: 271 | timestamp = matchObj.group(1) 272 | weekday, month, day, time, year = (str.split(timestamp)) 273 | day = day_converter(day) 274 | month = month_converter(month) 275 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 276 | #print(inserttime) 277 | #print(month) 278 | #print(day) 279 | #print(year) 280 | #print(time) 281 | #print ("Timestamp: ", timestamp) 282 | 283 | #insert to database 284 | cursor = db.cursor() 285 | datainsert = (inserttime, actiondesc, '', '' ,) 286 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 287 | db.commit() 288 | 289 | matchObj = re.search( r"(Attempting Delta patch update of )", line) #Regex for Delta patch 290 | if matchObj: 291 | actiondesc = "Attempting Delta patch" 292 | #print(actiondesc) 293 | #print("Made container:") 294 | matchObj = re.search( r"(?<=Attempting Delta patch update of )(.*)(?= from)", line) #Regex for bundle id 295 | if matchObj: 296 | bundleid = matchObj.group(1) 297 | #print ("Bundle ID: ", bundleid ) 298 | 299 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 300 | if matchObj: 301 | timestamp = matchObj.group(1) 302 | weekday, month, day, time, year = (str.split(timestamp)) 303 | day = day_converter(day) 304 | month = month_converter(month) 305 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 306 | #print(inserttime) 307 | #print(month) 308 | #print(day) 309 | #print(year) 310 | #print(time) 311 | #print ("Timestamp: ", timestamp) 312 | 313 | matchObj = re.search( r"(?<= from )(.*)", line) #Regex for path 314 | if matchObj: 315 | path = matchObj.group(1) 316 | #print ("Path: ", matchObj.group(1)) 317 | #print(inserttime, actiondesc, bundleid, path) 318 | 319 | #insert to database 320 | cursor = db.cursor() 321 | datainsert = (inserttime, actiondesc, bundleid, path ,) 322 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 323 | db.commit() 324 | 325 | #print() 326 | try: 327 | print () 328 | print ('iOS Mobile Installation Logs Parser') 329 | print ('By: @AlexisBrignoni') 330 | print ('Web: abrignoni.com') 331 | print () 332 | print ('Logs processed: ', filescounter) 333 | print ('Lines processed: ', counter) 334 | print () 335 | file.close 336 | 337 | 338 | 339 | #Initialize counters 340 | totalapps = 0 341 | installedcount = 0 342 | uninstallcount = 0 343 | historicalcount = 0 344 | sysstatecount = 0 345 | 346 | #created folders for reports and sub folders for App history, App state 347 | os.makedirs("./Apps_State/") 348 | os.makedirs("./Apps_Historical/") 349 | os.makedirs("./System_State/") 350 | 351 | #Initialize text file reports for installed and unistalled apps 352 | f1=open('./Apps_State/UninstalledApps.txt', 'w+', encoding="utf8") 353 | f2=open('./Apps_State/InstalledApps.txt', 'w+', encoding="utf8") 354 | f4=open('./System_State/SystemState.txt', 'w+', encoding="utf8") 355 | 356 | 357 | #Initialize database connection 358 | db = sqlite3.connect('mib.db') 359 | 360 | cursor = db.cursor() 361 | 362 | #Query to create installed and uninstalled app reports 363 | cursor.execute('''SELECT distinct bundle_id from dimm''') 364 | all_rows = cursor.fetchall() 365 | for row in all_rows: 366 | #print(row[0]) 367 | distinctbundle = row[0] 368 | cursor.execute('''SELECT * from dimm where bundle_id=? order by time_stamp desc limit 1''', (distinctbundle,)) 369 | all_rows_iu = cursor.fetchall() 370 | for row in all_rows_iu: 371 | #print(row[0], row[1], row[2], row[3]) 372 | if row[2] == '': 373 | continue 374 | elif row[1] == 'Destroying container': 375 | #print(row[0], row[1], row[2], row[3]) 376 | uninstallcount = uninstallcount + 1 377 | totalapps = totalapps + 1 378 | #tofile1 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 379 | tofile1 = row[2] + '\n' 380 | f1.write(tofile1) 381 | #print() 382 | elif row[1] == 'Uninstalling identifier': 383 | #print(row[0], row[1], row[2], row[3]) 384 | uninstallcount = uninstallcount + 1 385 | totalapps = totalapps + 1 386 | #tofile1 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 387 | tofile1 = row[2] + '\n' 388 | f1.write(tofile1) 389 | #print() 390 | else: 391 | #print(row[0], row[1], row[2], row[3]) 392 | tofile2 = row[2] + '\n' 393 | 394 | f2.write(tofile2) 395 | installedcount = installedcount + 1 396 | totalapps = totalapps + 1 397 | 398 | f1.close() 399 | f2.close() 400 | 401 | #Query to create historical report per app 402 | 403 | cursor.execute('''SELECT distinct bundle_id from dimm''') 404 | all_rows = cursor.fetchall() 405 | for row in all_rows: 406 | #print(row[0]) 407 | distinctbundle = row[0] 408 | if row[0] == '': 409 | continue 410 | else: 411 | f3=open('./Apps_Historical/' + distinctbundle + '.txt', 'w+', encoding="utf8") #Create historical app report per app 412 | cursor.execute('''SELECT * from dimm where bundle_id=? order by time_stamp DESC''', (distinctbundle,)) #Query to create app history per bundle_id 413 | all_rows_hist = cursor.fetchall() 414 | for row in all_rows_hist: 415 | #print(row[0], row[1], row[2], row[3]) 416 | tofile3 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 417 | f3.write(tofile3) 418 | f3.close() 419 | historicalcount = historicalcount + 1 420 | 421 | #Query to create system events 422 | 423 | cursor.execute('''SELECT * from dimm where action ='Reboot detected' order by time_stamp DESC''') 424 | all_rows = cursor.fetchall() 425 | for row in all_rows: 426 | #print(row[0]) 427 | #print(row[0], row[1], row[2], row[3]) 428 | tofile4 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 429 | f4.write(tofile4) 430 | sysstatecount = sysstatecount + 1 431 | 432 | 433 | 434 | 435 | print ('Total apps: ', totalapps) 436 | print ('Total installed apps: ', installedcount) 437 | print ('Total uninstalled apps: ', uninstallcount) 438 | print ('Total historical app reports: ', historicalcount) 439 | print ('Total system state events: ', sysstatecount) 440 | f1.close() 441 | f2.close() 442 | f4.close() 443 | 444 | except: 445 | print("Log files not found in "+input_path) 446 | 447 | gui.msgbox("Processing completed.\nReports located at "+os.path.abspath(os.path.dirname(sys.argv[0]))+"\n\nLogs processed: "+str(filescounter)+"\nLines processed: "+str(counter)+"\n\nTotal apps: "+str(totalapps)+"\nTotal installed apps: "+str(installedcount)+"\nTotal uninstalled apps: "+str(uninstallcount)+"\nTotal historical app reports: "+str(historicalcount)+"\nTotal system state events: "+str(sysstatecount),"iOS Mobile Installaion Logs Parser", "Ok" ) 448 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Note: This parser has been deprecated in favor of iLEAPP. 2 | Donwload iLEAPP in order to support the mobile installation logs artifact. 3 | 4 | # iOS-Mobile-Installation-Logs-Parser 5 | 6 | ![alt text](/images/mib_done.PNG "Usage example") 7 | 8 | Script parses all the logs in the /private/var/installd/Library/Logs/MobileInstalation/*.log* 9 | 10 | Script will produce a currently installed apps report, a uninstalled apps report and historical 11 | reports for both types per app. 12 | 13 | The types of rows extracted from the logs are for installed apps, 14 | moved containers, made live containers and destroyed containers. 15 | 16 | Usage: 17 | 18 | 1) Python 3.6.4 or newer. 19 | 2) Put the script in the same directory as the extracted mobile_installation.log.* files. 20 | 3) Run the script. 21 | 4) Script will produce a SQLite database named mib.db. 22 | 5) Script will produce two directories named Apps_Historical and Apps_State. Apps_Historical contains text files per app with coresponding app entries. App_State contains two text files, one for installed apps and another for uninstalled apps. 23 | 24 | In order to run the script again the script generated directories and SQLite db files need to be deleted or moved out of the running directory. 25 | 26 | Update on 1/17/2019 27 | Added: 28 | - Uninstall identifier events 29 | - Attempting delta patch events with version numbers 30 | - System reboot events 31 | 32 | Update 11/30/2019 33 | Added: 34 | - GUI version. Requires pip install easygui 35 | -------------------------------------------------------------------------------- /images/README.md: -------------------------------------------------------------------------------- 1 | Script use images 2 | -------------------------------------------------------------------------------- /images/mib_done.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/abrignoni/iOS-Mobile-Installation-Logs-Parser/3bcee11809ebffd0c70959831b261cad934cbf54/images/mib_done.PNG -------------------------------------------------------------------------------- /mib_parser.sql.py: -------------------------------------------------------------------------------- 1 | #Script to extract to process the mobile instalation logs. Normalize output and import to sqlite database for report generation. 2 | import sys, os, re, sqlite3, glob 3 | 4 | #initialize counters 5 | counter = 0 6 | filescounter = 0 7 | 8 | #Month to numeric with leading zero when month < 10 function 9 | #Function call: month = month_converter(month) 10 | def month_converter(month): 11 | months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'] 12 | month = months.index(month) + 1 13 | if (month < 10): 14 | month = f"{month:02d}" 15 | return month 16 | 17 | #Day with leading zero if day < 10 function 18 | #Functtion call: day = day_converter(day) 19 | def day_converter(day): 20 | day = int(day) 21 | if (day < 10): 22 | day = f"{day:02d}" 23 | return day 24 | 25 | #Create sqlite databases 26 | db = sqlite3.connect('mib.db') 27 | 28 | cursor = db.cursor() 29 | 30 | #Create table fileds for destroyed, installed, moved and made identifiers. 31 | 32 | cursor.execute(''' 33 | 34 | CREATE TABLE dimm(time_stamp TEXT, action TEXT, bundle_id TEXT, 35 | 36 | path TEXT) 37 | 38 | ''') 39 | 40 | db.commit() 41 | 42 | 43 | 44 | #Search for Installed applications 45 | #for filename in glob.glob('*.log*'): 46 | #file = open('mobile_installation.log.1', 'r', encoding="utf8") 47 | 48 | 49 | for filename in glob.glob('*.log.*'): 50 | file = open(filename, 'r', encoding='utf8' ) 51 | filescounter = filescounter + 1 52 | for line in file: 53 | counter = counter+1 54 | matchObj = re.search( r"(Install Successful for)", line) #Regex for installed applications 55 | ''' Old code 56 | if matchObj: 57 | actiondesc = "Install successful" 58 | #print(actiondesc) 59 | matchObj = re.search( r"(?<=for \()(.*)(?=\))", line) #Regex for bundle id 60 | if matchObj: 61 | bundleid = matchObj.group(1) 62 | #print ("Bundle ID: ", bundleid ) 63 | ''' 64 | if matchObj: 65 | actiondesc = "Install successful" 66 | matchObj1 = re.search( r"(?<= for \(Placeholder:)(.*)(?=\))", line) #Regex for bundle id 67 | matchObj2 = re.search( r"(?<= for \(Customer:)(.*)(?=\))", line) #Regex for bundle id 68 | matchObj3 = re.search( r"(?<= for \(System:)(.*)(?=\))", line) #Regex for bundle id 69 | matchObj4 = re.search( r"(?<= for \()(.*)(?=\))", line) #Regex for bundle id 70 | if matchObj1: 71 | bundleid = matchObj1.group(1) 72 | elif matchObj2: 73 | bundleid = matchObj2.group(1) 74 | elif matchObj3: 75 | bundleid = matchObj3.group(1) 76 | elif matchObj4: 77 | bundleid = matchObj4.group(1) 78 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 79 | if matchObj: 80 | timestamp = matchObj.group(1) 81 | weekday, month, day, time, year = (str.split(timestamp)) 82 | day = day_converter(day) 83 | month = month_converter(month) 84 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 85 | #print(inserttime) 86 | #print(month) 87 | #print(day) 88 | #print(year) 89 | #print(time) 90 | #print ("Timestamp: ", timestamp) 91 | 92 | #print(inserttime, actiondesc, bundleid) 93 | 94 | #insert to database 95 | cursor = db.cursor() 96 | datainsert = (inserttime, actiondesc, bundleid, '' ,) 97 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 98 | db.commit() 99 | 100 | #print() 101 | 102 | 103 | matchObj = re.search( r"(Destroying container with identifier)", line) #Regex for destroyed containers 104 | if matchObj: 105 | actiondesc = "Destroying container" 106 | #print(actiondesc) 107 | #print("Destroyed containers:") 108 | matchObj = re.search( r"(?<=identifier )(.*)(?= at )", line) #Regex for bundle id 109 | if matchObj: 110 | bundleid = matchObj.group(1) 111 | #print ("Bundle ID: ", bundleid ) 112 | 113 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 114 | if matchObj: 115 | timestamp = matchObj.group(1) 116 | weekday, month, day, time, year = (str.split(timestamp)) 117 | day = day_converter(day) 118 | month = month_converter(month) 119 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 120 | #print(inserttime) 121 | #print(month) 122 | #print(day) 123 | #print(year) 124 | #print(time) 125 | #print ("Timestamp: ", timestamp) 126 | 127 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 128 | if matchObj: 129 | path = matchObj.group(1) 130 | #print ("Path: ", matchObj.group(1)) 131 | 132 | 133 | #print(inserttime, actiondesc, bundleid, path) 134 | 135 | #insert to database 136 | cursor = db.cursor() 137 | datainsert = (inserttime, actiondesc, bundleid, path ,) 138 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 139 | db.commit() 140 | 141 | #print() 142 | 143 | 144 | matchObj = re.search( r"(Data container for)", line) #Regex Moved data containers 145 | if matchObj: 146 | actiondesc = "Data container moved" 147 | #print(actiondesc) 148 | #print("Data container moved:") 149 | matchObj = re.search( r"(?<=for )(.*)(?= is now )", line) #Regex for bundle id 150 | if matchObj: 151 | bundleid = matchObj.group(1) 152 | #print ("Bundle ID: ", bundleid ) 153 | 154 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 155 | if matchObj: 156 | timestamp = matchObj.group(1) 157 | weekday, month, day, time, year = (str.split(timestamp)) 158 | day = day_converter(day) 159 | month = month_converter(month) 160 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 161 | #print(inserttime) 162 | #print(month) 163 | #print(day) 164 | #print(year) 165 | #print(time) 166 | #print ("Timestamp: ", timestamp) 167 | 168 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 169 | if matchObj: 170 | path = matchObj.group(1) 171 | #print ("Path: ", matchObj.group(1)) 172 | 173 | #print(inserttime, actiondesc, bundleid, path) 174 | 175 | #insert to database 176 | cursor = db.cursor() 177 | datainsert = (inserttime, actiondesc, bundleid, path ,) 178 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 179 | db.commit() 180 | 181 | #print() 182 | 183 | matchObj = re.search( r"(Made container live for)", line) #Regex for made container 184 | if matchObj: 185 | actiondesc = "Made container live" 186 | #print(actiondesc) 187 | #print("Made container:") 188 | matchObj = re.search( r"(?<=for )(.*)(?= at)", line) #Regex for bundle id 189 | if matchObj: 190 | bundleid = matchObj.group(1) 191 | #print ("Bundle ID: ", bundleid ) 192 | 193 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 194 | if matchObj: 195 | timestamp = matchObj.group(1) 196 | weekday, month, day, time, year = (str.split(timestamp)) 197 | day = day_converter(day) 198 | month = month_converter(month) 199 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 200 | #print(inserttime) 201 | #print(month) 202 | #print(day) 203 | #print(year) 204 | #print(time) 205 | #print ("Timestamp: ", timestamp) 206 | 207 | matchObj = re.search( r"(?<= at )(.*)(?=$)", line) #Regex for path 208 | if matchObj: 209 | path = matchObj.group(1) 210 | #print ("Path: ", matchObj.group(1)) 211 | #print(inserttime, actiondesc, bundleid, path) 212 | 213 | #insert to database 214 | cursor = db.cursor() 215 | datainsert = (inserttime, actiondesc, bundleid, path ,) 216 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 217 | db.commit() 218 | 219 | matchObj = re.search( r"(Uninstalling identifier )", line) #Regex for made container 220 | if matchObj: 221 | actiondesc = "Uninstalling identifier" 222 | #print(actiondesc) 223 | #print("Uninstalling identifier") 224 | matchObj = re.search( r"(?<=Uninstalling identifier )(.*)", line) #Regex for bundle id 225 | if matchObj: 226 | bundleid = matchObj.group(1) 227 | #print ("Bundle ID: ", bundleid ) 228 | 229 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 230 | if matchObj: 231 | timestamp = matchObj.group(1) 232 | weekday, month, day, time, year = (str.split(timestamp)) 233 | day = day_converter(day) 234 | month = month_converter(month) 235 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 236 | #print(inserttime) 237 | #print(month) 238 | #print(day) 239 | #print(year) 240 | #print(time) 241 | #print ("Timestamp: ", timestamp) 242 | 243 | #insert to database 244 | cursor = db.cursor() 245 | datainsert = (inserttime, actiondesc, bundleid, '' ,) 246 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 247 | db.commit() 248 | 249 | matchObj = re.search( r"(main: Reboot detected)", line) #Regex for reboots 250 | if matchObj: 251 | actiondesc = "Reboot detected" 252 | #print(actiondesc) 253 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 254 | if matchObj: 255 | timestamp = matchObj.group(1) 256 | weekday, month, day, time, year = (str.split(timestamp)) 257 | day = day_converter(day) 258 | month = month_converter(month) 259 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 260 | #print(inserttime) 261 | #print(month) 262 | #print(day) 263 | #print(year) 264 | #print(time) 265 | #print ("Timestamp: ", timestamp) 266 | 267 | #insert to database 268 | cursor = db.cursor() 269 | datainsert = (inserttime, actiondesc, '', '' ,) 270 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 271 | db.commit() 272 | 273 | matchObj = re.search( r"(Attempting Delta patch update of )", line) #Regex for Delta patch 274 | if matchObj: 275 | actiondesc = "Attempting Delta patch" 276 | #print(actiondesc) 277 | #print("Made container:") 278 | matchObj = re.search( r"(?<=Attempting Delta patch update of )(.*)(?= from)", line) #Regex for bundle id 279 | if matchObj: 280 | bundleid = matchObj.group(1) 281 | #print ("Bundle ID: ", bundleid ) 282 | 283 | matchObj = re.search( r"(?<=^)(.*)(?= \[)", line) #Regex for timestamp 284 | if matchObj: 285 | timestamp = matchObj.group(1) 286 | weekday, month, day, time, year = (str.split(timestamp)) 287 | day = day_converter(day) 288 | month = month_converter(month) 289 | inserttime = str(year)+ '-'+ str(month) + '-' + str(day) + ' ' + str(time) 290 | #print(inserttime) 291 | #print(month) 292 | #print(day) 293 | #print(year) 294 | #print(time) 295 | #print ("Timestamp: ", timestamp) 296 | 297 | matchObj = re.search( r"(?<= from )(.*)", line) #Regex for path 298 | if matchObj: 299 | path = matchObj.group(1) 300 | #print ("Path: ", matchObj.group(1)) 301 | #print(inserttime, actiondesc, bundleid, path) 302 | 303 | #insert to database 304 | cursor = db.cursor() 305 | datainsert = (inserttime, actiondesc, bundleid, path ,) 306 | cursor.execute('INSERT INTO dimm (time_stamp, action, bundle_id, path) VALUES(?,?,?,?)', datainsert) 307 | db.commit() 308 | 309 | #print() 310 | 311 | print () 312 | print ('iOS Mobile Installation Logs Parser') 313 | print ('By: @AlexisBrignoni') 314 | print ('Web: abrignoni.com') 315 | print () 316 | print ('Logs processed: ', filescounter) 317 | print ('Lines processed: ', counter) 318 | print () 319 | file.close 320 | 321 | #Initialize counters 322 | totalapps = 0 323 | installedcount = 0 324 | uninstallcount = 0 325 | historicalcount = 0 326 | sysstatecount = 0 327 | 328 | #created folders for reports and sub folders for App history, App state 329 | os.makedirs("./Apps_State/") 330 | os.makedirs("./Apps_Historical/") 331 | os.makedirs("./System_State/") 332 | 333 | #Initialize text file reports for installed and unistalled apps 334 | f1=open('./Apps_State/UninstalledApps.txt', 'w+', encoding="utf8") 335 | f2=open('./Apps_State/InstalledApps.txt', 'w+', encoding="utf8") 336 | f4=open('./System_State/SystemState.txt', 'w+', encoding="utf8") 337 | 338 | 339 | #Initialize database connection 340 | db = sqlite3.connect('mib.db') 341 | 342 | cursor = db.cursor() 343 | 344 | #Query to create installed and uninstalled app reports 345 | cursor.execute('''SELECT distinct bundle_id from dimm''') 346 | all_rows = cursor.fetchall() 347 | for row in all_rows: 348 | #print(row[0]) 349 | distinctbundle = row[0] 350 | cursor.execute('''SELECT * from dimm where bundle_id=? order by time_stamp desc limit 1''', (distinctbundle,)) 351 | all_rows_iu = cursor.fetchall() 352 | for row in all_rows_iu: 353 | #print(row[0], row[1], row[2], row[3]) 354 | if row[2] == '': 355 | continue 356 | elif row[1] == 'Destroying container': 357 | #print(row[0], row[1], row[2], row[3]) 358 | uninstallcount = uninstallcount + 1 359 | totalapps = totalapps + 1 360 | #tofile1 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 361 | tofile1 = row[2] + '\n' 362 | f1.write(tofile1) 363 | #print() 364 | elif row[1] == 'Uninstalling identifier': 365 | #print(row[0], row[1], row[2], row[3]) 366 | uninstallcount = uninstallcount + 1 367 | totalapps = totalapps + 1 368 | #tofile1 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 369 | tofile1 = row[2] + '\n' 370 | f1.write(tofile1) 371 | #print() 372 | else: 373 | #print(row[0], row[1], row[2], row[3]) 374 | tofile2 = row[2] + '\n' 375 | 376 | f2.write(tofile2) 377 | installedcount = installedcount + 1 378 | totalapps = totalapps + 1 379 | 380 | f1.close() 381 | f2.close() 382 | 383 | #Query to create historical report per app 384 | 385 | cursor.execute('''SELECT distinct bundle_id from dimm''') 386 | all_rows = cursor.fetchall() 387 | for row in all_rows: 388 | #print(row[0]) 389 | distinctbundle = row[0] 390 | if row[0] == '': 391 | continue 392 | else: 393 | f3=open('./Apps_Historical/' + distinctbundle + '.txt', 'w+', encoding="utf8") #Create historical app report per app 394 | cursor.execute('''SELECT * from dimm where bundle_id=? order by time_stamp DESC''', (distinctbundle,)) #Query to create app history per bundle_id 395 | all_rows_hist = cursor.fetchall() 396 | for row in all_rows_hist: 397 | #print(row[0], row[1], row[2], row[3]) 398 | tofile3 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 399 | f3.write(tofile3) 400 | f3.close() 401 | historicalcount = historicalcount + 1 402 | 403 | #Query to create system events 404 | 405 | cursor.execute('''SELECT * from dimm where action ='Reboot detected' order by time_stamp DESC''') 406 | all_rows = cursor.fetchall() 407 | for row in all_rows: 408 | #print(row[0]) 409 | #print(row[0], row[1], row[2], row[3]) 410 | tofile4 = row[0] + ' ' + row[1] + ' ' + row[2] + ' ' + row[3] + '\n' 411 | f4.write(tofile4) 412 | sysstatecount = sysstatecount + 1 413 | 414 | 415 | 416 | 417 | print ('Total apps: ', totalapps) 418 | print ('Total installed apps: ', installedcount) 419 | print ('Total uninstalled apps: ', uninstallcount) 420 | print ('Total historical app reports: ', historicalcount) 421 | print ('Total system state events: ', sysstatecount) 422 | f1.close() 423 | f2.close() 424 | f4.close() 425 | -------------------------------------------------------------------------------- /test data/README.md: -------------------------------------------------------------------------------- 1 | Test logs for script. 2 | See usage. 3 | -------------------------------------------------------------------------------- /test data/mobile_installation.log.0: -------------------------------------------------------------------------------- 1 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.google.Gmail added ref for keychain group group.com.google.Gmail 2 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.google.Gmail added ref for keychain group EQHXZ8M8AV.com.google.Gmail 3 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.google.Gmail added ref for keychain group EQHXZ8M8AV.com.google.common.SSO 4 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.google.Gmail added ref for keychain group group.com.google.common 5 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.google.Gmail is now at /private/var/mobile/Containers/Data/Application/EBDE7CDA-70AD-424A-AAB8-B59A883AFB09 6 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.google.Gmail.ShareExtension at /private/var/mobile/Containers/Data/PluginKitPlugin/47E1F648-8F8C-499B-A27B-E0EB69BA7427 7 | Thu Nov 22 21:07:35 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.google.Gmail at /private/var/containers/Bundle/Application/A8EE57F4-C78E-4D27-8926-766616EE9DA4 8 | Thu Nov 22 21:07:36 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.google.Gmail); Staging: 2.92s; Waiting: 0.00s; Preflight/Patch: 0.24s, Verifying: 9.10s; Overall: 12.82s 9 | Sat Dec 1 08:20:27 2018 [47] (0x16bbeb000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtension.appex because it doesn't work on this OS version 10 | Sat Dec 1 08:20:27 2018 [47] (0x16bbeb000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtensionUI.appex because it doesn't work on this OS version 11 | Sun Dec 2 11:04:17 2018 [47] (0x16bad3000) -[MIClientConnection uninstallIdentifiers:withOptions:completion:]: Uninstall requested by lsd (pid 87) for identifier com.zhiliaoapp.musically with options: (null) 12 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstaller _uninstallBundleWithIdentifier:error:]: Uninstalling identifier com.zhiliaoapp.musically 13 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for group.test.zhiliaoapp.shared 14 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically.TodayWidget 15 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically.dev 16 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically.test 17 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.shared 18 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically 19 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for group.com.zhiliaoapp.shared 20 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically.PushNotificationAttachment 21 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for group.dev.zhiliaoapp.shared 22 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.zhiliaoapp.musically for 4QGCBVR5TL.com.zhiliaoapp.musically.VideoPushNotification 23 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIKeychainAccessGroupTracker _removeGroupsWithError:error:]: Removing keychain access groups: ( 24 | "group.test.zhiliaoapp.shared", 25 | "4QGCBVR5TL.com.zhiliaoapp.musically.TodayWidget", 26 | "4QGCBVR5TL.com.zhiliaoapp.musically.dev", 27 | "4QGCBVR5TL.com.zhiliaoapp.musically.test", 28 | "4QGCBVR5TL.com.zhiliaoapp.shared", 29 | "4QGCBVR5TL.com.zhiliaoapp.musically", 30 | "group.com.zhiliaoapp.shared", 31 | "4QGCBVR5TL.com.zhiliaoapp.musically.PushNotificationAttachment", 32 | "group.dev.zhiliaoapp.shared", 33 | "4QGCBVR5TL.com.zhiliaoapp.musically.VideoPushNotification" 34 | ) 35 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.zhiliaoapp.musically at /private/var/containers/Bundle/Application/60176EFB-BF30-4B0A-8CF2-970C0D5D0BBE 36 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.zhiliaoapp.musically at /private/var/mobile/Containers/Data/Application/3B0886CB-6F96-413C-BE74-A2A34FF214A2 37 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.zhiliaoapp.musically.PushNotificationAttachment at /private/var/mobile/Containers/Data/PluginKitPlugin/3F66BC8D-5E14-4554-B47C-9615AE8A538D 38 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.zhiliaoapp.musically.TodayWidget at /private/var/mobile/Containers/Data/PluginKitPlugin/DBA7078E-DFAA-49F0-A8B8-2CCEC14D2794 39 | Sun Dec 2 11:04:22 2018 [47] (0x16bad3000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.zhiliaoapp.musically.VideoPushNotification at /private/var/mobile/Containers/Data/PluginKitPlugin/3264503F-A42B-495C-B7A4-CEBB774235A8 40 | Sun Dec 2 11:05:18 2018 [47] (0x16bad3000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/88A32DD3-79DD-420E-830B-D5BB3D5E846A/Dropbox.app" type Placeholder (LSInstallType = 1) requested by lsd (pid 87) 41 | Sun Dec 2 11:05:19 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Installing 42 | Sun Dec 2 11:05:19 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox at /private/var/mobile/Containers/Data/Application/07EC59CF-6441-4E55-AA1F-26A9F6F3931A 43 | Sun Dec 2 11:05:19 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.iMessageExtension at /private/var/mobile/Containers/Data/PluginKitPlugin/F7A1BA4B-AFB0-48EF-8F08-1F957FDDB2A9 44 | Sun Dec 2 11:05:19 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox at /private/var/containers/Bundle/Application/43F1FCE4-5D60-4553-9379-A732E7F59FD6 45 | Sun Dec 2 11:05:19 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.getdropbox.Dropbox); Staging: 0.10s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 0.21s 46 | Sun Dec 2 11:05:19 2018 [47] (0x16bb5f000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.getdropbox.Dropbox installType = 1 failureReason = 0 underlyingError = (null) failureSource = 0 47 | Sun Dec 2 11:05:36 2018 [47] (0x16ba47000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 48 | Sun Dec 2 11:05:36 2018 [47] (0x16bb5f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/4864DAB9-C22B-4B52-B4D1-89D48C4AE026/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 49 | Sun Dec 2 11:05:36 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Installing 50 | Sun Dec 2 11:05:47 2018 [47] (0x16bb5f000) -[MIInstallableBundle _validateApplicationIdentifierForNewBundleSigningInfo:error:]: Allowing update to app com.getdropbox.Dropbox even though the older version does not have the application-identifier entitlement. 51 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIInstallableBundle finalizeInstallationWithError:]: App no longer needs data container for plugin with id com.getdropbox.Dropbox.iMessageExtension; removing it 52 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.DropboxTodayView 53 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.ActionExtension 54 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.DropboxKeychainFamily 55 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.DropboxShareExtension 56 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.FileProviderUI 57 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.ActionExtension 58 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.DocPicker 59 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.FileProviderUI 60 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.DropboxTodayView 61 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.iMessage 62 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.DocPicker 63 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.DropboxShareExtension 64 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.FileProvider 65 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox 66 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox.iMessage 67 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group 8KM394JM3R.com.getdropbox.Dropbox.FileProvider 68 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIKeychainAccessGroupTracker _onQueue_updateReferencesWithOldBundle:newBundle:error:]: Updated bundle com.getdropbox.Dropbox added ref for keychain group group.com.getdropbox.Dropbox 69 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox is now at /private/var/mobile/Containers/Data/Application/9A93A386-2EAF-4AF0-8002-BBE7AC4247E1 70 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.ActionExtension at /private/var/mobile/Containers/Data/PluginKitPlugin/30D88275-F248-4A80-B406-431DC9D93268 71 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.DropboxTodayView at /private/var/mobile/Containers/Data/PluginKitPlugin/18E855AD-49B9-4D98-B0F7-F125A15733DF 72 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.FileProviderUI at /private/var/mobile/Containers/Data/PluginKitPlugin/6DCE660A-BAC9-4D4D-9DC3-33604A8E42C3 73 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.iMessage at /private/var/mobile/Containers/Data/PluginKitPlugin/26AFD39F-196F-4595-9018-C53C1FE9A045 74 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.DocPicker at /private/var/mobile/Containers/Data/PluginKitPlugin/69ADF15F-D8E9-4072-9139-44CCD1E2961A 75 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.FileProvider at /private/var/mobile/Containers/Data/PluginKitPlugin/307D4BA0-AF5D-4293-865D-38EB6C04E932 76 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox.DropboxShareExtension at /private/var/mobile/Containers/Data/PluginKitPlugin/BB115F02-7901-403D-A30D-E577E08ECE1B 77 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox at /private/var/containers/Bundle/Application/46CC7524-09FD-4714-9441-EECD1CB12EB0 78 | Sun Dec 2 11:05:48 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.getdropbox.Dropbox); Staging: 0.74s; Waiting: 0.00s; Preflight/Patch: 0.08s, Verifying: 10.58s; Overall: 12.33s 79 | Sun Dec 2 11:52:44 2018 [47] (0x16ba47000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/5372A8F1-1766-4302-83E4-31D9F11F476B/Slack.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 80 | Sun Dec 2 11:52:44 2018 [47] (0x16bb5f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/5AD590C1-F8C9-4122-99D0-14D019942BEC/Microsoft Outlook.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 81 | Sun Dec 2 11:52:45 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Installing 82 | Sun Dec 2 11:52:45 2018 [47] (0x16ba47000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 83 | Sun Dec 2 11:52:45 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Installing 84 | Sun Dec 2 11:52:45 2018 [47] (0x16bb5f000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 85 | Sun Dec 2 11:52:45 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.tinyspeck.chatlyio); Staging: 0.05s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 0.65s 86 | Sun Dec 2 11:52:45 2018 [47] (0x16bad3000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.tinyspeck.chatlyio installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 87 | Sun Dec 2 11:52:46 2018 [47] (0x16ba47000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 88 | Sun Dec 2 11:52:46 2018 [47] (0x16bbeb000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/F166C3DE-5D20-4BED-BE69-B1FAE0DBE11D/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 89 | Sun Dec 2 11:52:46 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 0.01s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 1.34s 90 | Sun Dec 2 11:52:46 2018 [47] (0x16bad3000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.microsoft.Office.Outlook installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 91 | Sun Dec 2 11:52:46 2018 [47] (0x16bb5f000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 92 | Sun Dec 2 11:52:46 2018 [47] (0x16bad3000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/F4670A4A-7892-4F05-897C-B31C4DEB1622/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 93 | Sun Dec 2 11:52:47 2018 [47] (0x16bbeb000) -[MIInstaller performInstallationWithError:]: Installing 94 | Sun Dec 2 11:52:47 2018 [47] (0x16bbeb000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.tinyspeck.chatlyio from 399202 (3.56) to 399418 (3.57) 95 | Sun Dec 2 11:52:51 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Installing 96 | Sun Dec 2 11:53:18 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio is now at /private/var/mobile/Containers/Data/Application/E875FCC0-E697-47CA-B4C6-EB2198400BCD 97 | Sun Dec 2 11:53:18 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio.share is now at /private/var/mobile/Containers/Data/PluginKitPlugin/99EFC77D-0E2F-48F9-95CD-BC7AA9934D83 98 | Sun Dec 2 11:53:18 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio.NotificationService is now at /private/var/mobile/Containers/Data/PluginKitPlugin/2C07AA84-9198-4CBD-8A2E-2C2026899727 99 | Sun Dec 2 11:53:18 2018 [47] (0x16bbeb000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.tinyspeck.chatlyio at /private/var/containers/Bundle/Application/D66D79B6-2348-4383-BEC7-435AD8BE9BF7 100 | Sun Dec 2 11:53:18 2018 [47] (0x16bbeb000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.tinyspeck.chatlyio); Staging: 1.67s; Waiting: 0.00s; Preflight/Patch: 7.50s, Verifying: 22.30s; Overall: 32.11s 101 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook is now at /private/var/mobile/Containers/Data/Application/2B6EA2F1-B2A2-42BB-A8FB-F7AB95DC1C27 102 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.compose-shareextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/5039965E-653C-46B9-B59E-18DB71C83846 103 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationContentExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/4BD9B755-BC3A-45AD-82EC-98B8359D63A5 104 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.agenda-widgetextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/10540268-11FA-4726-B40D-332ADB059FFB 105 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationServiceExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/B3C89163-0734-4833-B605-D98C14C61EB4 106 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.microsoft.Office.Outlook at /private/var/containers/Bundle/Application/4520B12D-A952-4824-BBAD-66A33586954C 107 | Sun Dec 2 11:53:19 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 4.26s; Waiting: 0.00s; Preflight/Patch: 0.36s, Verifying: 26.51s; Overall: 32.75s 108 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIClientConnection uninstallIdentifiers:withOptions:completion:]: Uninstall requested by lsd (pid 87) for identifier com.microsoft.rdc.ios with options: (null) 109 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIUninstaller _uninstallBundleWithIdentifier:error:]: Uninstalling identifier com.microsoft.rdc.ios 110 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.microsoft.rdc.ios for SGGM6D27TK.com.microsoft.rdc.ios.intunemam 111 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.microsoft.rdc.ios for SGGM6D27TK.com.microsoft.intune.mam 112 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.microsoft.rdc.ios for SGGM6D27TK.com.microsoft.adalcache 113 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.microsoft.rdc.ios for SGGM6D27TK.com.microsoft.rdc.ios 114 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _onQueue_removeReferencesForBundle:error:]: Removing reference in com.microsoft.rdc.ios for SGGM6D27TK.com.microsoft.workplacejoin 115 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIKeychainAccessGroupTracker _removeGroupsWithError:error:]: Removing keychain access groups: ( 116 | "SGGM6D27TK.com.microsoft.rdc.ios.intunemam", 117 | "SGGM6D27TK.com.microsoft.rdc.ios" 118 | ) 119 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.microsoft.rdc.ios at /private/var/containers/Bundle/Application/194F00A7-8274-425F-AAB2-3BDD8600184D 120 | Fri Dec 28 21:17:22 2018 [47] (0x16ba47000) -[MIUninstallNotifier performRemovalWithCompletionBlock:]: Destroying container with identifier com.microsoft.rdc.ios at /private/var/mobile/Containers/Data/Application/F9E31B53-F992-42C9-9880-F2A9A6C9F9C6 121 | Fri Dec 28 22:15:55 2018 [47] (0x16bb5f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/438CD337-CE90-425C-980A-3229A6A97A1B/Gmail - Email by Google.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 122 | Fri Dec 28 22:15:55 2018 [47] (0x16ba47000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/637E0827-D698-4C5B-9B54-97F95519ED9E/Microsoft Outlook.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 123 | Fri Dec 28 22:15:55 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Installing 124 | Fri Dec 28 22:15:55 2018 [47] (0x16ba47000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 125 | Fri Dec 28 22:15:55 2018 [47] (0x16bc77000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/A9602DE5-72DC-4FE0-9497-50B097E90C17/Dropbox.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 126 | Fri Dec 28 22:15:55 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Installing 127 | Fri Dec 28 22:15:55 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Installing 128 | Fri Dec 28 22:15:55 2018 [47] (0x16bb5f000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 129 | Fri Dec 28 22:15:55 2018 [47] (0x16bc77000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 130 | Fri Dec 28 22:15:56 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.google.Gmail); Staging: 0.03s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 0.46s 131 | Fri Dec 28 22:15:56 2018 [47] (0x16bb5f000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.google.Gmail installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 132 | Fri Dec 28 22:15:56 2018 [47] (0x16bbeb000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 133 | Fri Dec 28 22:15:56 2018 [47] (0x16bad3000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/5A1D1C92-E519-4043-8B40-0DB815CCEF4E/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 134 | Fri Dec 28 22:15:57 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 0.01s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.00s; Overall: 1.45s 135 | Fri Dec 28 22:15:57 2018 [47] (0x16bbeb000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.microsoft.Office.Outlook installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 136 | Fri Dec 28 22:15:57 2018 [47] (0x16bb5f000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 137 | Fri Dec 28 22:15:57 2018 [47] (0x16bd03000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/DD13F4BF-F316-4CEE-B6F2-EB9E13A539BB/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 138 | Fri Dec 28 22:15:57 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.getdropbox.Dropbox); Staging: 0.13s; Waiting: 0.00s; Preflight/Patch: 0.02s, Verifying: 0.02s; Overall: 2.21s 139 | Fri Dec 28 22:15:58 2018 [47] (0x16bd8f000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.getdropbox.Dropbox installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 140 | Fri Dec 28 22:15:58 2018 [47] (0x16bd8f000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 141 | Fri Dec 28 22:15:58 2018 [47] (0x16bb5f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/83AB9F29-3EF3-439C-9DFB-A893ABB900D3/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 142 | Fri Dec 28 22:15:59 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Installing 143 | Fri Dec 28 22:15:59 2018 [47] (0x16bb5f000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.getdropbox.Dropbox from 122.2.2 (122.2) to 124.2.2 (124.2) 144 | Fri Dec 28 22:16:00 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Installing 145 | Fri Dec 28 22:16:00 2018 [47] (0x16bad3000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.google.Gmail from 5.0.181103.838889 (5.0.181103) to 5.0.181119.845780 (5.0.181119) 146 | Fri Dec 28 22:16:04 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Installing 147 | Fri Dec 28 22:16:48 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.google.Gmail is now at /private/var/mobile/Containers/Data/Application/8D40C2DA-3C9B-4920-A142-D34AA74212F1 148 | Fri Dec 28 22:16:48 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.google.Gmail.ShareExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/44CF4F2D-90E6-491E-8A5D-B7EFF632E0F1 149 | Fri Dec 28 22:16:48 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.google.Gmail at /private/var/containers/Bundle/Application/86BF8EA2-A94C-463A-A1A3-6CCC0424487E 150 | Fri Dec 28 22:16:49 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.google.Gmail); Staging: 3.52s; Waiting: 0.00s; Preflight/Patch: 19.33s, Verifying: 28.86s; Overall: 52.66s 151 | Fri Dec 28 22:16:51 2018 [47] (0x16bd8f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/ACC6DD89-26C0-418D-9374-FC2A645FB3AE/Nike Run Club.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 152 | Fri Dec 28 22:16:51 2018 [47] (0x16bd8f000) -[MIInstaller performInstallationWithError:]: Installing 153 | Fri Dec 28 22:16:51 2018 [47] (0x16bd8f000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 154 | Fri Dec 28 22:16:51 2018 [47] (0x16bd8f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.nike.nikeplus-gps); Staging: 0.02s; Waiting: 0.00s; Preflight/Patch: 0.01s, Verifying: 0.02s; Overall: 0.31s 155 | Fri Dec 28 22:16:52 2018 [47] (0x16ba47000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.nike.nikeplus-gps installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 156 | Fri Dec 28 22:16:52 2018 [47] (0x16bad3000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 157 | Fri Dec 28 22:16:52 2018 [47] (0x16bad3000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/8ADBFFFA-064F-4DD7-AE60-47E4CE9A9924/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 158 | Fri Dec 28 22:16:52 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Installing 159 | Fri Dec 28 22:16:52 2018 [47] (0x16bad3000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.nike.nikeplus-gps from 1811021912 (5.20.0) to 1812090157 (5.21.0) 160 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox is now at /private/var/mobile/Containers/Data/Application/2EBA08BC-710E-4B5A-8D76-087DE6B846CA 161 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.ActionExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/2958D62E-D837-4241-BE4A-332C68DFE8D1 162 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.DropboxTodayView is now at /private/var/mobile/Containers/Data/PluginKitPlugin/7DC61AC4-5B1E-43C5-94F0-B4969762FC2E 163 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.FileProviderUI is now at /private/var/mobile/Containers/Data/PluginKitPlugin/3B7AC489-FD7A-4545-B7EF-4EAB1911E493 164 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.iMessage is now at /private/var/mobile/Containers/Data/PluginKitPlugin/EA91B010-97B1-4A1A-98C2-9D7E73333F6D 165 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.DocPicker is now at /private/var/mobile/Containers/Data/PluginKitPlugin/0D0EE0DF-B256-4F60-B0F6-6D41698DCC8A 166 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.FileProvider is now at /private/var/mobile/Containers/Data/PluginKitPlugin/99975D65-F806-4276-A3A5-F5952EBC2C1B 167 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.getdropbox.Dropbox.DropboxShareExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/905C93CC-85D1-46D1-BD20-2681D864DD69 168 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.getdropbox.Dropbox at /private/var/containers/Bundle/Application/1F1E94E1-F849-43E2-83AE-1C0A739EC856 169 | Fri Dec 28 22:16:58 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.getdropbox.Dropbox); Staging: 1.43s; Waiting: 0.00s; Preflight/Patch: 24.65s, Verifying: 33.26s; Overall: 59.87s 170 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook is now at /private/var/mobile/Containers/Data/Application/FC2A7C01-35E5-416A-9520-A6FB4FD83FE7 171 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.compose-shareextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/53E879B7-6407-4A98-AEED-3D0EF37A1952 172 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationContentExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/55BBB14C-74BC-4AF2-9BB0-D40E47651B85 173 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.agenda-widgetextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/0A0C8875-1E2F-4005-8319-BFAE0FF3295E 174 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationServiceExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/5E007866-BBE1-4B89-9C6D-7DB9C37D7042 175 | Fri Dec 28 22:16:58 2018 [47] (0x16bd03000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.microsoft.Office.Outlook at /private/var/containers/Bundle/Application/0C4ADF64-4FD9-49A7-8C3D-60D8AA4CE713 176 | Fri Dec 28 22:16:59 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 6.74s; Waiting: 0.00s; Preflight/Patch: 1.00s, Verifying: 52.44s; Overall: 61.38s 177 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/1F781136-DB61-4F50-98EA-DEE0FCABF875/Yahoo Mail - Stay Organized.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 178 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIInstaller performInstallationWithError:]: Installing 179 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 180 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtension.appex because it doesn't work on this OS version 181 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtensionUI.appex because it doesn't work on this OS version 182 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.yahoo.Aerogram); Staging: 0.02s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.00s; Overall: 0.56s 183 | Fri Dec 28 22:17:00 2018 [47] (0x16be1b000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.yahoo.Aerogram installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 184 | Fri Dec 28 22:17:00 2018 [47] (0x16c0d7000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 185 | Fri Dec 28 22:17:00 2018 [47] (0x16c0d7000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/5410F41D-9386-4F97-908A-BC7BC6F1EC23/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 186 | Fri Dec 28 22:17:01 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Installing 187 | Fri Dec 28 22:17:01 2018 [47] (0x16c0d7000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.yahoo.Aerogram from 43877 (4.34.1) to 44013 (4.35) 188 | Fri Dec 28 22:17:01 2018 [47] (0x16bd03000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/A59BB036-30A9-4C85-9600-404F49804EBB/Discord.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 189 | Fri Dec 28 22:17:01 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Installing 190 | Fri Dec 28 22:17:01 2018 [47] (0x16bd03000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 191 | Fri Dec 28 22:17:01 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.hammerandchisel.discord); Staging: 0.02s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 0.25s 192 | Fri Dec 28 22:17:02 2018 [47] (0x16bd03000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.hammerandchisel.discord installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 193 | Fri Dec 28 22:17:02 2018 [47] (0x16be1b000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 194 | Fri Dec 28 22:17:02 2018 [47] (0x16bd03000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/E2F678B2-DA01-450C-9F88-E1B2BF62EC62/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 195 | Fri Dec 28 22:17:02 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Installing 196 | Fri Dec 28 22:17:02 2018 [47] (0x16bd03000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.hammerandchisel.discord from 8812 (2.3.10) to 9714 (2.4.0) 197 | Fri Dec 28 22:17:07 2018 [47] (0x16c0d7000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.WzCb3K/extracted/Payload/Raven.app/PlugIns/IntentExtension.appex because it doesn't work on this OS version 198 | Fri Dec 28 22:17:07 2018 [47] (0x16c0d7000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.WzCb3K/extracted/Payload/Raven.app/PlugIns/IntentExtensionUI.appex because it doesn't work on this OS version 199 | Fri Dec 28 22:17:13 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.hammerandchisel.discord is now at /private/var/mobile/Containers/Data/Application/061F67A2-C73A-4EE3-B366-3A786B8A5B68 200 | Fri Dec 28 22:17:13 2018 [47] (0x16bd03000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.hammerandchisel.discord.Share is now at /private/var/mobile/Containers/Data/PluginKitPlugin/4169EF99-D474-4674-958A-00D29A643469 201 | Fri Dec 28 22:17:13 2018 [47] (0x16bd03000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.hammerandchisel.discord at /private/var/containers/Bundle/Application/584D5563-A42C-4775-81AC-D7653868B2B1 202 | Fri Dec 28 22:17:13 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.hammerandchisel.discord); Staging: 0.06s; Waiting: 0.00s; Preflight/Patch: 2.15s, Verifying: 8.39s; Overall: 10.81s 203 | Fri Dec 28 22:17:14 2018 [47] (0x16bd03000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/FAFA6DD5-611F-46C3-A074-FB9A3ED07808/Slack.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 204 | Fri Dec 28 22:17:14 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Installing 205 | Fri Dec 28 22:17:14 2018 [47] (0x16bd03000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 206 | Fri Dec 28 22:17:14 2018 [47] (0x16bd03000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.tinyspeck.chatlyio); Staging: 0.03s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.01s; Overall: 0.25s 207 | Fri Dec 28 22:17:14 2018 [47] (0x16bbeb000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.tinyspeck.chatlyio installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 208 | Fri Dec 28 22:17:15 2018 [47] (0x16bd03000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 209 | Fri Dec 28 22:17:15 2018 [47] (0x16bbeb000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/A3E6C62D-B876-4026-BD30-7D2470867B63/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 210 | Fri Dec 28 22:17:15 2018 [47] (0x16bbeb000) -[MIInstaller performInstallationWithError:]: Installing 211 | Fri Dec 28 22:17:15 2018 [47] (0x16bbeb000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.tinyspeck.chatlyio from 399418 (3.57) to 399636 (3.58) 212 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtension.appex because it doesn't work on this OS version 213 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIBundle pluginKitBundlesSkippingPlatformValidation:withError:]: Ignoring plugin at /private/var/containers/Bundle/Application/14BF9EE2-A0E4-455E-9CD7-2D76BCAB1183/Raven.app/PlugIns/IntentExtensionUI.appex because it doesn't work on this OS version 214 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.yahoo.Aerogram is now at /private/var/mobile/Containers/Data/Application/418637E2-2A18-46EE-9D28-211FD2AD5250 215 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.yahoo.Aerogram.NotificationContentExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/43E62075-D1D4-48F6-B47B-D7B7BBBB3B22 216 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.yahoo.Aerogram.CallDirectoryExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/D20E2FE1-5894-4A3E-A60D-F7427069FCDE 217 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.yahoo.Aerogram.NotificationServiceExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/60829963-C8FF-4596-8FB6-F46941006B6B 218 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.yahoo.Aerogram.ShareExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/72B4FA08-1C03-486B-874A-A39A19B99491 219 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.yahoo.Aerogram at /private/var/containers/Bundle/Application/6D0D00EA-740D-4CB3-8F79-F770B2409251 220 | Fri Dec 28 22:17:16 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.yahoo.Aerogram); Staging: 0.46s; Waiting: 0.00s; Preflight/Patch: 6.50s, Verifying: 8.10s; Overall: 15.38s 221 | Fri Dec 28 22:17:18 2018 [47] (0x16bc77000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/98B5E1B3-90CA-4F0C-9704-4C5373B1A48F/Blizzard Battle.net.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 222 | Fri Dec 28 22:17:18 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Installing 223 | Fri Dec 28 22:17:18 2018 [47] (0x16bc77000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 224 | Fri Dec 28 22:17:18 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.blizzard.social); Staging: 0.04s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.00s; Overall: 0.37s 225 | Fri Dec 28 22:17:18 2018 [47] (0x16bc77000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.blizzard.social installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 226 | Fri Dec 28 22:17:18 2018 [47] (0x16bd8f000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 227 | Fri Dec 28 22:17:19 2018 [47] (0x16ba47000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/DBF09FFF-F5CA-4C7E-9535-F57EB42ABB74/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 228 | Fri Dec 28 22:17:19 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Installing 229 | Fri Dec 28 22:17:19 2018 [47] (0x16ba47000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.blizzard.social from 2879 (1.3.4) to 3514 (1.4.1) 230 | Fri Dec 28 22:17:21 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps is now at /private/var/mobile/Containers/Data/Application/42B50035-7B2F-4D61-ADA5-4AA431350648 231 | Fri Dec 28 22:17:21 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps.messagesextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/6969C4A1-882B-4106-B8B6-FBEBC4DEABA6 232 | Fri Dec 28 22:17:21 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps.intentsextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/9539A371-41B6-4721-9E18-80DFCC060E22 233 | Fri Dec 28 22:17:21 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.nike.nikeplus-gps at /private/var/containers/Bundle/Application/3F24B44B-24BF-4D90-994F-147393468E92 234 | Fri Dec 28 22:17:21 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.nike.nikeplus-gps); Staging: 0.67s; Waiting: 0.00s; Preflight/Patch: 10.01s, Verifying: 18.02s; Overall: 29.52s 235 | Fri Dec 28 22:17:25 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio is now at /private/var/mobile/Containers/Data/Application/9A8F4B0C-2387-4DC7-B9EC-EDFEEE5993A5 236 | Fri Dec 28 22:17:25 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio.share is now at /private/var/mobile/Containers/Data/PluginKitPlugin/7A8D7166-010A-46CC-AB9B-09A92A67827F 237 | Fri Dec 28 22:17:25 2018 [47] (0x16bbeb000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.tinyspeck.chatlyio.NotificationService is now at /private/var/mobile/Containers/Data/PluginKitPlugin/ADE8941F-32F7-4FA5-AF6C-C0F7861A837D 238 | Fri Dec 28 22:17:25 2018 [47] (0x16bbeb000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.tinyspeck.chatlyio at /private/var/containers/Bundle/Application/D76B2FA9-F5D0-447F-B9F0-0FA78615B887 239 | Fri Dec 28 22:17:25 2018 [47] (0x16bbeb000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.tinyspeck.chatlyio); Staging: 0.34s; Waiting: 0.00s; Preflight/Patch: 7.17s, Verifying: 2.37s; Overall: 10.30s 240 | Fri Dec 28 22:17:30 2018 [47] (0x16ba47000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.blizzard.social is now at /private/var/mobile/Containers/Data/Application/6068CC22-AF64-4C54-A2DE-F0EC25E10F35 241 | Fri Dec 28 22:17:30 2018 [47] (0x16ba47000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.blizzard.social at /private/var/containers/Bundle/Application/9BF0BB3B-C388-4985-8C7F-999A8CA7AC02 242 | Fri Dec 28 22:17:30 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.blizzard.social); Staging: 0.65s; Waiting: 0.00s; Preflight/Patch: 9.59s, Verifying: 0.95s; Overall: 11.89s 243 | Sun Dec 30 19:10:55 2018 [47] (0x16c0d7000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/8CA251A5-B4AE-4A80-85ED-7D2D7FD48ADD/Discord.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 244 | Sun Dec 30 19:10:55 2018 [47] (0x16ba47000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/15EF5334-0842-426B-BFAC-E783FED2DD09/Microsoft Outlook.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 245 | Sun Dec 30 19:10:55 2018 [47] (0x16bb5f000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/2BF93C6B-9C4E-48D0-A517-917FF7A55AB9/Nike Run Club.app" type Placeholder (LSInstallType = 5) requested by lsd (pid 87) 246 | Sun Dec 30 19:10:55 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Installing 247 | Sun Dec 30 19:10:55 2018 [47] (0x16ba47000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 248 | Sun Dec 30 19:10:55 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Installing 249 | Sun Dec 30 19:10:55 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Installing 250 | Sun Dec 30 19:10:55 2018 [47] (0x16c0d7000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 251 | Sun Dec 30 19:10:55 2018 [47] (0x16bb5f000) -[MIInstallableParallelPlaceholder performInstallationWithError:]: Installing parallel placeholder 252 | Sun Dec 30 19:10:55 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.hammerandchisel.discord); Staging: 0.20s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.02s; Overall: 0.59s 253 | Sun Dec 30 19:10:56 2018 [47] (0x16bad3000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.hammerandchisel.discord installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 254 | Sun Dec 30 19:10:56 2018 [47] (0x16bad3000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 255 | Sun Dec 30 19:10:56 2018 [47] (0x16c0d7000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/562FAC4E-6DBA-4E3E-BA6E-E73CCE97CFA1/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 256 | Sun Dec 30 19:10:57 2018 [47] (0x16ba47000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 0.21s; Waiting: 0.00s; Preflight/Patch: 0.00s, Verifying: 0.02s; Overall: 2.27s 257 | Sun Dec 30 19:10:57 2018 [47] (0x16bbeb000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.microsoft.Office.Outlook installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 258 | Sun Dec 30 19:10:58 2018 [47] (0x16bb5f000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.nike.nikeplus-gps); Staging: 0.13s; Waiting: 0.00s; Preflight/Patch: 0.06s, Verifying: 0.02s; Overall: 2.45s 259 | Sun Dec 30 19:10:58 2018 [47] (0x16bc77000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 260 | Sun Dec 30 19:10:58 2018 [47] (0x16bad3000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/59319051-309F-4CDC-8360-085ADBF88F85/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 261 | Sun Dec 30 19:10:58 2018 [47] (0x16bb5f000) -[MIClientConnection updatePlaceholderMetadataForApp:installType:failureReason:underlyingError:failureSource:completion:]: Update placeholder metadata requested by client installcoordinationd (pid 101) for app com.nike.nikeplus-gps installType = 5 failureReason = 0 underlyingError = (null) failureSource = 0 262 | Sun Dec 30 19:10:59 2018 [47] (0x16ba47000) -[MIClientConnection installURL:withOptions:completion:]: Running installation as QOS_CLASS_USER_INITIATED 263 | Sun Dec 30 19:10:59 2018 [47] (0x16bc77000) -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.installcoordinationd/Library/InstallCoordination/PromiseStaging/F1E732A9-DF1C-409D-A726-6ED10687FA02/extract" type Customer (LSInstallType = 0) requested by lsd (pid 87) 264 | Sun Dec 30 19:11:00 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Installing 265 | Sun Dec 30 19:11:00 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Installing 266 | Sun Dec 30 19:11:00 2018 [47] (0x16bc77000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.nike.nikeplus-gps from 1812090157 (5.21.0) to 1812110127 (5.21.1) 267 | Sun Dec 30 19:11:01 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Installing 268 | Sun Dec 30 19:11:01 2018 [47] (0x16bad3000) -[MIInstallableBundlePatch applyPatchWithError:]: Attempting Delta patch update of com.microsoft.Office.Outlook from 1325516 (3.1.0) to 1380021 (3.2.2) 269 | Sun Dec 30 19:11:03 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.hammerandchisel.discord is now at /private/var/mobile/Containers/Data/Application/DB6B4198-B222-4963-BE2C-C8FAD4FEBF26 270 | Sun Dec 30 19:11:03 2018 [47] (0x16c0d7000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.hammerandchisel.discord.Share is now at /private/var/mobile/Containers/Data/PluginKitPlugin/4177AC2B-6D6D-48A1-897A-9438ADB2B2A3 271 | Sun Dec 30 19:11:03 2018 [47] (0x16c0d7000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.hammerandchisel.discord at /private/var/containers/Bundle/Application/8FFFCEDE-748A-49BC-92F2-E3B04D73FF1C 272 | Sun Dec 30 19:11:03 2018 [47] (0x16c0d7000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.hammerandchisel.discord); Staging: 3.34s; Waiting: 0.00s; Preflight/Patch: 0.04s, Verifying: 3.46s; Overall: 7.28s 273 | Sun Dec 30 19:11:16 2018 [47] (0x16bc77000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps is now at /private/var/mobile/Containers/Data/Application/3DBED368-EA47-44D5-8336-461A20563810 274 | Sun Dec 30 19:11:16 2018 [47] (0x16bc77000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps.messagesextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/BF4F51A7-5EE7-40C9-B108-0D639A3F22CE 275 | Sun Dec 30 19:11:16 2018 [47] (0x16bc77000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.nike.nikeplus-gps.intentsextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/6C82618C-8E09-466D-AAB6-70B2AD712E52 276 | Sun Dec 30 19:11:16 2018 [47] (0x16bc77000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.nike.nikeplus-gps at /private/var/containers/Bundle/Application/49C071A1-F21D-49CC-ACDA-CC66C75ABEF9 277 | Sun Dec 30 19:11:16 2018 [47] (0x16bc77000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.nike.nikeplus-gps); Staging: 1.32s; Waiting: 0.00s; Preflight/Patch: 6.60s, Verifying: 9.00s; Overall: 17.70s 278 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook is now at /private/var/mobile/Containers/Data/Application/C192D72C-36FE-4FE7-8B80-B15887EECE65 279 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.compose-shareextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/E743E379-CA79-4426-A69D-FD2AB9E72227 280 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationContentExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/5A0DA760-405A-4D59-A523-E101C6805D39 281 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.agenda-widgetextension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/15DBB767-232B-4C41-B3D0-3CEFF851692C 282 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstallableBundle _refreshUUIDForContainer:withError:]: Data container for com.microsoft.Office.Outlook.NotificationServiceExtension is now at /private/var/mobile/Containers/Data/PluginKitPlugin/CC58CD76-C389-4175-849A-F54CDE2483AB 283 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIContainer makeContainerLiveReplacingContainer:reason:withError:]: Made container live for com.microsoft.Office.Outlook at /private/var/containers/Bundle/Application/30FAD25A-946C-4DA6-8EC5-2ADA6E10B024 284 | Sun Dec 30 19:11:26 2018 [47] (0x16bad3000) -[MIInstaller performInstallationWithError:]: Install Successful for (com.microsoft.Office.Outlook); Staging: 2.83s; Waiting: 0.00s; Preflight/Patch: 15.06s, Verifying: 10.18s; Overall: 28.79s 285 | --------------------------------------------------------------------------------