4

If I want to uninstall a program and remove all trace of data it stored on my computer, is there a tool to see where a program has written data? I expect it isn't going to be possible after the fact, but perhaps there is something that can run when a program is first launched to monitor all the locations to which it writes?

I think I'm looking for something that does for local storage what Little Snitch does for the internet.

Improve this question
3
  • A very hard problem to attack without the OS enforcing a strict sandbox or in the case where the programs simple and you can install it in a clean environment to run it to see all the places it typically writes.
    – bmike ♦
    Dec 22, 2011 at 5:46
  • But the second scenario is doable, no? In fact, you just gave me an idea about a solution to my own question.
    – Daniel ♦
    Dec 22, 2011 at 6:06
  • 1
    I love virtual machines :-) that and rsync and grep
    – bmike ♦
    Dec 23, 2011 at 0:11

4 Answers 4

Reset to default
11

If I get it right, you want to monitor all file-system operations of your app when you launch it and when it's running ?
Rather than finding each and every byte that this program has ever written to your hard-drive.

For the first case I have two recommendations:

fseventer

  • Instruments.app from /Developer/Applications/ (you need Xcode for that)
    • Choosing "File Activity" from the templates

Instruments

Supplement from 2011-12-22

  • And for the command-line, copied from here

    sudo opensnoop -p PID

Shows you all of the files that are being accessed on your system by a particular process (by passing its PID)

Improve this answer
1

There method isn't as automated as other options, but it has the advantage that it finds files associated with an app even if they aren't used during the monitoring session.

I use an app called Find Any File, which lets you search your entire hard drive easily using some complex queries.

This method relies on the assumption that all app files either have the name of the app in the filename, or are stored somewhere with the name of the app in an enclosing folder's name. This is almost always true; Application Support, login items/launchagents/launchdaemons, caches, the app bundle itself, etc all follow it.
I've yet to find an app with files in non-obvious places that don't follow this rule.

Here's how I would formulate my query for the app Balsamiq Mockups, which I installed a few days ago:

enter image description here

The reason I've got the two parts of the name separately is to cover cases where there is a space between the two words (like the app bundle) as well as where there isn't (like a com.developer.AppName file).

The Modification Date is within the past ... component is optional and only helpful when the app has been installed relatively recently. Generally, just the app name should be just fine.

The results show all the files that the app has created:

enter image description here

I've got the view in hierarchical mode to show the location of the files, but either view mode is fine.

If you want to delete the files, switch to the list view, select them all, right click and choose Move to Trash.

enter image description here

Bonus: If the app has a custom file extension, you can easily round up all of those files too: Name ends in .ext

Improve this answer
2
  • I'm suspicious of the claim that all app files either have the name of the app in the filename, or are stored somewhere with the name of the app in an enclosing folder's name, but I don't have a counterexample yet. I'm not convinced, but I am intrigued. Thanks.
    – Daniel ♦
    Dec 22, 2011 at 1:26
  • You do have a point, but I've tested this with quite a few apps and never found one where it doesn't work.
    – Nathan Greenstein
    Dec 22, 2011 at 1:30
0

This isn't ideal, but here's another idea:

  • Create a new user account.
  • In terminal:
    • touch ~/Desktop/first_dir
    • touch ~/Desktop/second_dir
    • ls -laR ~ > ~/Desktop/first_dir
  • Install the program in question
  • Run it
  • In terminal:
    • ls -laR ~ > ~/Desktop/second_dir
    • diff ~/Desktop/first_dir ~/Desktop/second_dir
Improve this answer
0

The command line is the most efficient option here, just use the command lsof (list open files) with the relevant options, you can limit the results to file opened all, by user, by parent process, by group ID, etc.

Type in man lsof to the Terminal for all the options.

Another option is use the Activity Monitor app, locate your running app in the list, double click it, then select 'open files and ports'.

Improve this answer
1
  • lsof or Activity Monitor just take a snapshot, though, right? It's just the files open at the point in time when the command is run?
    – Daniel ♦
    Dec 28, 2011 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .