0

Inside my Documents folder there are a bunch of folders named with what appear to be hexidecimal numbers, eg. 01, 1b, 84, aa, etc. Often they're empty, but some have one or two files named with a hash: 5aaebbb6c171adb2159c17cd1c8e629fc774f1be.file I assume the files are binaries because when I open them in a text editor they consist of rows of eight two digit hex values, 00eb babf 314c 00eb babf 3130 d3aa 0109. I deleted the folders a few weeks ago, but they slowly grew back.

My question is twofold:

  1. What is writing these files/folders?

  2. And because I doubt it can be diagnosed from my description, how do I monitor and figure out what is writing them?

I'm on 10.11, El Capitan.

I sometimes run a Windows VM in VirtualBox, I run Vagrant from the command line, and Docker as well. I run phpstorm, Spotify, uTorrent, Steam, Slack, Skitch, Xcode, Tunnel Bear. The list goes on. I guess what I'm looking for is a strategy or technique to figure out which application is writing.

Improve this question
  • Please add your system version! Have you already verified (and repaired - if necessary) the main file system. Are these files and folders added/growing continuously/after a reboot/after each reboot? – klanomath Nov 13 '16 at 13:04
  • Can you provide the version of MacOS you're running? Also, have you ever changed the default location of the iTunes music library or where it saves iOS backup files? In addition, do you have any sort of Windows emulation software installed (e.g. Parallels, VMWare Fusion, VirtualBox, etc)? What about other 3rd party software that isn't too common? Finally, do you use any specialised software? – Monomeeth♦ Nov 13 '16 at 13:04
  • I sometimes run a windows vm in VirtualBox, I run vagrant from the command line, and docker as well. I run phpstorm, spotify, uTorrent, Steam, Slack, Skitch, Xcode, Tunnel Bear. The list goes on. I guess what I'm looking for is a strategy or technique to figure out which application is writing. Maybe I should just delete them again then keep an eye on the folder and see if I can find a correlation. – icicleking Nov 14 '16 at 1:41
2

A few things for you to try:

Per this SO link, do lsof path-to-filename to list all processes accessing that file. There's also a frontend to lsof called Sloth. The problem with this is if the programme doing the writes only edits the file momentarily (like if it did touch foldername) then you probably wouldn't see it, since lsof only lists current processes' access to the file.

Alternatively, get FSeventer (direct download link from archive.org - in my (klanomath's) opinion the only reliable source), which graphically monitors filesystem IO events. You could probably set it to run on your documents folder and then wait for one of those writes to happen, although based on your description that may take a while. The website for FSeventer seems to be down right now :(, but if/when it goes back up it may be able to solve your problem. FSeventer isn't really ElCap ready and often fails to work after the first launch - usually it works after launching it a second time.

Improve this answer
1

This is specific to my set up, and I didn't do anything in particular to find out what was writing to Documents. But, maybe this will help someone in the future. Spotify was set up to write cache to Documents.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .