/private/var

This folder is the mount point for /dev/disk0s2 ( /dev/disk0s1s2 on modern iOS versions), which is the device's user/data partition. This deviates from the Filesystem Hierarchy Standard which places this at /var , however, a sym-link is placed at /var that redirects to here, so it is at least somewhat compliant.

It is the larger of the two partitions, and stores all App Store applications, iTunes media, settings, photos, etc.

Before iPhone OS 1.1.3 (1.1.2 and below) all of this data was stored in /private/var/root. However, for security reasons, in 1.1.3 Apple made most applications run under the user mobile, and moved all of the data to /private/var/mobile.

Children

Folders

• audit (unused; iOS 6.0+?)
• backups (unused)
• buddy (unused)
• cache (used by apt-get and GNU Find Utilities )
• containers
• db
• ea (unused; iOS 6.0+?)
• empty
• folders (unused)
• keybags (iOS 4.0+)
• Keychains
• lib
• local
• lock
• log
• logs (which contains /private/var/logs/AppleSupport)
• Managed Preferences
• mobile (home folder for mobile user)
• MobileAsset
• MobileDevice
• MobileSoftwareUpdate (used for OTA Updates; iOS 5.0+)
• msgs
• networkd
• personalized_factory (unused)
• preferences
• root (home folder for root user)
• run (used by lockdownd)
• select (unused)
• spool (unused)
• staged_system_apps (empty)
• stash (created by Cydia)
• tmp (/dev/disk0s3)
• vm (unused in iOS =
• wireless (iOS 4.0+)