0

After macOS minor upgrade of Monterey I've noticed that a directory of mine has been deleted. is there a way to check in retrospect which process deleted my directory ?

I know of fsevents, but it's used to record ongoing file activities... the question is how to get file auditing event from the past.

1

1 Answer 1

1

Unfortunately there's no such logging by default which would show you which program deleted a specific directory in the past.

2
  • Hi @jksoegaard and thanks for the info... Perhaps do you know if there's any process that can run in the background as deamon, that can monitor file events at all times (even during login window) ?
    – osxUser
    Nov 30, 2022 at 7:49
  • Yes, sure there are many programs like that. For example Time Machine backups works on a similar basis. You can't install them after the fact and get information about the past though.
    – jksoegaard
    Nov 30, 2022 at 8:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .