Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Now, I can find out which processes are opening files dynamically. However, for a file on my filesystem, is there a way to find out which process created the file?

I'm trying to differentiate a file I created by:


from one created by say, an NSAPI process running under my id.


will give me information such as which tty is doing something, is that an attribute I can access?

Essentially, my id does a bunch of stuff. Much of what my id does should be via applications, or from a terminal. I'd like to find out more. Suggestions?

share|improve this question
up vote 1 down vote accepted

Darwin is open source. I'm guessing you'll need to modify OS level things, a kernel extension, etc. and add this ability.

Or you could modify the dynamic-view tools you know (fs_usage and/or lsof), have them check if a file is being created, and append the process chain that created it into the Spotlight comment, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.