I am looking for an application that works on silicon macs that can snapshot my system and compare two snapshots showing me file creation/modification changes.

A long time ago there were a few apps that could show you file/port activity in the moment e.g. Sloth (still active) and fseventer, but there was also Uninstaller that would allow you to snapshot your system at various points and compare changes.

I'd like to be able to see what various installers and applications do to my file system after install/run.

Which scripts, tools or apps can show file system changes like Uninstaller did?


2 Answers 2


If you are shell-literate, you can use the built-in mtree(8) command to scan a directory and compare its contents with the results of another scan. This is the tool Apple uses to verify the integrity of macOS installations.

For example, to scan your home folder:

mtree -X exclude -k link -cn -p ~ > spec

Here, exclude is the name of (or path to) a file with a list of files to be excluded from the scan, and spec is the output file.

Then, to compare the results of that scan with the current state of the folder:

mtree -X exclude -k link -p ~ < spec

The changes will be printed to the standard output. If you want to pursue this idea further, see the man page for mtree.

  • Great option - TIL a new tool - thanks!
    – bmike
    Commented Jun 22 at 19:05

Apple delivers this as Time Machine functionality. By default most new macOS systems have APFS file systems which make the snapshots very fast.

tmutil – Time Machine utility

This is quite well documented and flexible if you open a shell and type man tmutil

compare [-@acdefglmnstuEUX] [-D depth] [-I name] [backup_path | path1 path2]

Perform a backup diff

If no arguments are provided, tmutil will compare the computer to the latest backup. If a backup path is provided as the sole argument, tmutil will compare the computer to the specified backup. If two path arguments are provided, tmutil will compare those two items to each other. tmutil will attempt to inform you when you have asked it to do something that doesn't make sense or isn't supported.

The compare verb allows you to specify what properties to compare. If you specify no property options, tmutil assumes a default property set of -@gmstu. Specifying any property option overrides the default set.

You can use the startbackup action to initiate a snapshot before you run the installer and a second as soon as it finishes to get as clean a report as possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .