mediaremoted

mediaremoted #

 full_path = "/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted"
 runs_as = "mobile"

Part of MediaRemote private framework.

 full_path = "/usr/sbin/mediaserverd"
 runs_as = "mobile"

Manages media routes and access on the idevice, amongst other things allows or denies camera access.

 full_path = "/usr/libexec/microstackshot"
 runs_as = "root"

Triggered during sysdiagnose. Aggregates and saves daily microstackshot call graphs to the diagnostic reports directory.

 full_path = "/usr/libexec/misagent"
 runs_as = "mobile"

 full_path = "/usr/libexec/misd"
 runs_as = "root"

 full_path = "/usr/libexec/mobileactivationd"
 runs_as = "mobile"

 full_path = "/usr/libexec/mobileassetd"
 runs_as = "root"

 full_path = "/System/Library/PrivateFrameworks/MobileBackup.framework/MobileBackupCacheDeleteService"
 runs_as = "root"

 full_path = "/usr/libexec/MobileGestaltHelper"
 runs_as = "mobile"

 relative_path = "logs/MobileInstallation/mobile_installation.log.{number}"

 relative_path = "logs/MobileInstallation/mobile_installation_helper.log.{number}"

mobileinstallation.log are plaintext files, accompanied with _helper files.

It has information about the apps installed in the last ~4 days.