How can I find out what files are installed by an installer program? Is there a program that can trace that during an installation of a new app?
You can press command-I in an installer window to see a list of files that would be copied by the installer:
You can also use
lsbom bundle.pkg/Contents/Archive.bom lsbom $(pkgutil --bom nonbundle.pkg)
If you have already installed a package, you can use
pkgutil --files or
pkgutil --files com.tapbots.TweetbotMac lsbom /var/db/receipts/com.tapbots.TweetbotMac.bom
There’s an app called Pacifist (shareware, $20) which allows you to inspect OS X package files and look at their contents. Quoting directly from their website:
This is useful, for instance, […] if you want to inspect a downloaded package to see what it will install before installing it.
You can download it for free (which has a 15 second delay on startup), or $20 to register. By using the Open Package command on an installer, you can look inside the installer package and find out what it’s doing. Usually you can find a script or similar, which you can use to see what gets installed and moved.
Within the Installer.app application, you can use the File > Show Files… menu to list the package contents. This list reflects the compressed files that Installer will copy onto your Mac.
Installer.app is launched when you open a standard installer package.
Be aware that an installer package,
mpkg, can install files using scripts or other methods that are difficult to detect.
To truly determine what files are installed or modified, you would need to track and monitor the installer package as it was being applied to your Mac. This includes tracking processes launched by the installer and the results of any scripts it runs.
If you are uncertain about an installer, contact the developer. We for example publish a list of files installed and any scripts used. It is good practice and customer demand will help push developers to share this detail.
If you are using 10.4.x "Tiger" or 10.5.x "Leopard" then fslogger is one way to log changes to your system. This and other options are discussed here:
List the files archived within the payload of the uninstalled flat package(s) contained at path. This should be equivalent to
"lsbom -s `pkgutil --bom path`". Note that flat package archives may contain more than one package, and the destination location for the uninstalled package(s) is unknown to this command.
pkgutil --payload-files node-v10.15.3.pkg
Using this flag, I was able to see the same list as presented by the "Show Files" command (⌘ + i) in Installer.