When I pulled the sd card (new sandisk ultra 256GB) to transfer the files from a new Wyzecam v4 to my computer hard drive, I found something I had never seen before on any SD card used with a Wyze camera (9 cameras over the past three or four years).
There is a folder named ‘cores’ that contains a 130KB file named “iotclient_151_11_1734489621.tar.gz” and an empty "upload’ subfolder.
I scanned with MS defender and Malwarebytes. Both scans gave a clean bill of health.
I’m hoping it is something harmless that I just happen to have never seen before.
If it’s a mystery to others, here are more details:
I have three new v4 cameras … all three put into service about a week ago. This is the only one that contains what I have outlined above.
The SD card (formatted by the v4 camera) has the standard folders /subfolders and files that I usually see:
“alarm” has subfolders and .jpg files
“record” has subfolders and .mp4 videos
“log” has .txt log files
“time_lapse” is empty
There is no “ota” folder.
There are no other files shown in the root directory.
Has anyone seen this before? Searches turn up nothing similar.
Is this part of the wyze cam system?
Is it something evil?
My guess is it is something related to a firmware update. What is contained inside the gzip archive?
(Or in reality inside the tarball).
Is it possible the microSD came with something on it or was used for something else? Given that it is called “iotclient” I suspect it is probably Wyze firmware though. Maybe one cam had an older firmware that needed a different upgrade procedure, or it didn’t clean up the file off the SD card after the update. Just guesses, I’m not positive how exactly the upgrade process goes but would not be surprised if it makes use of the SD card temporarily.
My three V4 cameras were put into service on December 9th - firmware updates done that day and none in the time since then.
The card in this v4 camera was last changed out three days ago (Dec 17th at 09:23pm ET). Yes, a 254 GB card swapped out after three days. I needed the clips for a project.
ABOUT SD CARD FORMATTING:
I would think (but could be wrong) that when the v4 camera formats the SD card it is a quick format that prepares the entire card for new data, however, until new data is written down on the card the previous data would be recoverable … but it wouldn’t show up as a folder or file without the help of a data recovery app.
DATE / TIME INFO:
Another possible clue: The date/times for the folder and archive file are as follows:
‘cores’ folder and ‘upload’ folder - 2024-12-18 02:50 (for modified and created dates)
‘iotclient…’ archive file - 2024-12-18 02:40 (for both modified and created dates)
The first mp4 file recorded was under
20241217
hour 21
and the first file was 23.mp4
which has a modified and created date of 2024-12-18 02:24
So, Wyze is using GMT for time stamping.
It also means that the strange folder and archive file seem to have been added about 25 minutes after the camera started recording continuous video data to the card.
Is it odd that the archive file has an earlier created and modified date/time (2024-12-18 02:40) than the folder it resides in (2024-12-18 02:50)?
OPENING THE ARCHIVE FILE:
Also, I have not looked in the archive file … yet. I’d rather know what it is before taking that step.
Just opening the archive will not run anything, just give you a listing of what is in it. First it will extract the gzip then prompt you to open the tar file, then it should give you a file listing.
I wouldn’t concern yourself too much with the dates and times as there is no guarantee the clock in the cam was accurate when the files were written.
Before putting any SD card in the cams, I always run them through a quick format with the SD card formatter utility from SDcard.org which ensures the file system, offset, size, etc are all set correctly. After that, the cam’s internal format seems to work fine as it is simply clearing off data and leaving the low level format and structure in place.
I honestly suspect the file is just something related to either a firmware update or the initial build of the card’s file structure that the camera was not able to delete after for whatever reason. Perhaps when you format the card, it drops that file on it, extracts it to create the folder structure, then deletes it, and that last step failed.
Pretty unlikely it is anything malicious. If you look at the file listing inside that archive I suspect you’ll either find a firmware file, or the empty folders that it puts on the card after formatting it.
