filecoordinationd

executablemacOS158.0 KBx86_64, arm64

Diagnostic data collector — gathers system metrics and telemetry for Apple

Collects diagnostic information about system performance, hardware state, and application behavior. Accesses private storage areas to retrieve logs and metrics data. Communicates with Apple's telemetry endpoints to transmit diagnostic reports, handling multiple network destinations for data delivery. Exposes an XPC service for other system components to submit diagnostic events and query collection status. References multiple bundle identifiers suggesting integration across various macOS subsystems.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 158.0 KB
UUID: CC642BE7-03E4-304D-8ADA-B68F63599DF6
Analyzed: 2026-04-07T05:21:12Z
CDHash: bfc94e871e3b82cb726e981bd5406f6fbe22c508ee5b65abed15dc25d819022f

Capabilities

StoragePrivate storage area access

com.apple.private.security.storage.MobileDocuments [object Object]

Frameworks5

APFS Foundation libSystem.B.dylib CoreFoundation libobjc.A.dylib

Entitlements7

com.apple.private.MobileContainerManager.otherIdLookuptrue

com.apple.private.security.datavault.controllertrue

com.apple.private.security.storage.MobileDocumentstrue

com.apple.private.tcc.allow

kTCCServiceSystemPolicyAllFiles

com.apple.private.vfs.dataless-manipulationtrue

com.apple.private.vfs.dataless-resolvertrue

com.apple.private.vfs.support-long-pathstrue

Interesting Strings

Bundle IDs(25)

'com.apple.private.vfs.dataless-resolver (com.apple.private.vfs.support-long-paths +com.apple.private.vfs.dataless-manipulation /AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/DerivedSources//AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/DerivedSources/arm64e/

File Paths(9)

/AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/DerivedSources//AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/DerivedSources/arm64e//AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/Objects-normal/arm64e/FCMain.o /AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/Objects-normal/arm64e/filecoordinationd_vers.o /AppleInternal/Library/BuildRoots/4~CAHYugBaV7ekrrlQtpGj6McwVongJPjLLNmxSP0/Library/Caches/com.apple.xbs/Binaries/Foundation/install/TempContent/Objects/Foundation.build/FileCoordinationDaemon.build/Objects-normal/arm64e/vfs_nspaceServer.o

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

HostnameFoundation-4109.1.401

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

1

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

0

File Paths

9

Bundle IDs

25

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code0fb9f8f347cb34fb80e204de04edc6cc773c469ad4efff37aa940676159c6e44

Imports7121988c902b4b77687b5dd2358efa269e7e268e7e01d946add536ac8f80e793

Frameworksba62476b9ecf677af05e0452f91178d2ce5891db42aae65d52b36fab7d1de38f

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements58e8e2ea61d26db42b3e9245392c4b1d33427db6ed963a9c7bad0a9c5a11246c

Symbols7121988c902b4b77687b5dd2358efa269e7e268e7e01d946add536ac8f80e793

Static Libraries0 / 32 functions identified

Functions(32)

0x100000978receive_nspace_handle

0x100000980receive_vfs_resolve_dir_with_audit_token

0x100000b00make_nspace_handle_response

0x100000c28handle_nspace_request_with_info

0x100000da4receive_vfs_resolve_file_with_audit_token

0x100000f2creceive_vfs_resolve_reparent_with_audit_token

0x100001204sub_100001204

0x100001274nspaceErrnoFromNSError

0x10000131csub_10000131c

0x10000132csub_10000132c

0x100001338receive_vfs_resolve_dir

0x10000148creceive_vfs_resolve_file

0x1000015ecreceive_nspace_resolve_path

0x100001720receive_nspace_resolve_cancel

0x1000017fcinit_mig_server

0x100001910sub_100001910

0x100001954sub_100001954

0x100001998main

0x100001a80sub_100001a80

0x100001ae4OUTLINED_FUNCTION_0

Imports45 symbols from 4 dylibs

libSystem.B.dylib29 Foundation9 libobjc.A.dylib5 CoreFoundation2

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

MSUEarlyBootTask

applessdstatistics

KernelEventAgent

DataDetectorsLocalSources