Can I use an APFS snapshot to generate a list of all files changed since an earlier point?

Question

I just clean installed macOS on a new VM and now need to set it up with various preferences and stuff to customize it. What I am curious about is where all those customizations actually get stored.

I think most are probably in Preferences plists but others might be in other system databases or third party app configuration files. Regardless, really I'm just wanting to see a list of files changed between "Point A" and some later "Point B" and this is probably interesting in a lot of other cases too.

Is there a way I can use the command line to:

1. Trigger an APFS snapshot of my "Macintosh HD" boot disk — starting point "A"
2. …then do whatever using the computer…
3. Then trigger a new snapshot and/or at least compare now at time "B" what files have been modified since the snapshot at "A"?

Don't need a GUI or anything, just commands that would mark the snapshot and echo out a list of files that changed later. And I don't really need any sort of diff showing the changes within each files, just the overall paths/names of ones that did. (Also not really interested here in solutions based on file modification timestamps; I want to really know at the lower level even if some file's metadata didn't get touched for some reason.)

Answer 1

Unfortunately, using the command line to do APFS snapshots manually is quite a bit involved:

The program that issues the request to make the snapshot is required to have the com.apple.developer.vfs.snapshot entitlement, which is basically a sort of "permission slip" from Apple for that feature. Apple only gives that entitlement out to specific types of programs (i.e. backup software, disk cloning software, etc) - but as far as I know, no generic, command line tool has been given the entitlement.

A number of generic, command line tools do however exist - for example this:

https://github.com/ahl/apfs

However, you have to manually give it the above mentioned entitlement. It's easy enough, but macOS won't validate that entitlement per default. You have to disable some of the security feature in macOS in order to get such "homemade entitlements" to work. Specifically you need to disable SIP and boot up with amfi_get_out_of_my_way set. There's guides available to follow if you want to go down that route.

However, I propose a simpler solution:

Use one of the existing, already entitled, programs to create snapshots - and compare them using standard tools.

One idea would be to setup Time Machine backups (if you haven't done so already). Disconnect the backup disk so that snapshots are created locally. They're created once per hour - so it can be a bit of a waiting game. Note that snapshots are only kept around for 24 hours by default.

You can use Disk Utility to mount the snapshots afterwards, and then run the diff -r dirA dirB command in the Terminal to compare the two folders.

You could also just run full Time Machine backups to a connected disk - then you do not have to wait an hour in between snapshots. You can then use software such as BackupLoupe to see exactly what was changed between two backups.

Another option is using the software CarbonCopyCloner to create the snapshots. You'll need to enable APFS snapshots for the startup volume in the settings.