How can I find out what files are installed by an installer program? Is there a program that can trace that during an installation of a new app?


You can press command-I in an installer window to see a list of files that would be copied by the installer:

You can also use lsbom:

lsbom bundle.pkg/Contents/Archive.bom
lsbom $(pkgutil --bom nonbundle.pkg)

If you have already installed a package, you can use pkgutil --files or lsbom:

pkgutil --files com.tapbots.TweetbotMac
lsbom /var/db/receipts/com.tapbots.TweetbotMac.bom

There’s an app called Pacifist (shareware, $20) which allows you to inspect OS X package files and look at their contents. Quoting directly from their website:

This is useful, for instance, […] if you want to inspect a downloaded package to see what it will install before installing it.

You can download it for free (which has a 15 second delay on startup), or $20 to register. By using the Open Package command on an installer, you can look inside the installer package and find out what it’s doing. Usually you can find a script or similar, which you can use to see what gets installed and moved.

  • Or, if one is not willing to use for-pay software unpkg is the tool of choice for exactly this purpose. – GhostLyrics Mar 25 '14 at 21:55

Within the Installer.app application, you can use the File > Show Files… menu to list the package contents. This list reflects the compressed files that Installer will copy onto your Mac.

Installer.app is launched when you open a standard installer package.

Be aware that an installer package, pkg and mpkg, can install files using scripts or other methods that are difficult to detect.

To truly determine what files are installed or modified, you would need to track and monitor the installer package as it was being applied to your Mac. This includes tracking processes launched by the installer and the results of any scripts it runs.

If you are uncertain about an installer, contact the developer. We for example publish a list of files installed and any scripts used. It is good practice and customer demand will help push developers to share this detail.


If you are using 10.4.x "Tiger" or 10.5.x "Leopard" then fslogger is one way to log changes to your system. This and other options are discussed here:


  • Hmmmm... Interesting.... A solution for an OS from at least 2005 to a question asked in 2015. – Allan Mar 15 '17 at 0:37

@Lri's answer is excellent and I want to add info about another flag for pkgutil. From the manpage:

--payload-files path

List the files archived within the payload of the uninstalled flat package(s) contained at path. This should be equivalent to "lsbom -s `pkgutil --bom path`". Note that flat package archives may contain more than one package, and the destination location for the uninstalled package(s) is unknown to this command.


pkgutil --payload-files node-v10.15.3.pkg

Using this flag, I was able to see the same list as presented by the "Show Files" command ( + i) in Installer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .