Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Find files created or modified by an installer Install
Do you like to know which files and folders get created or modified when you install a new application? I can suggest two different solutions: Either use a tool to track all file system changes, or use a tool that searches the disk by creation/modification dates.

[robg adds: This hint includes information about using a free program, Find Any File, as one way to track file system changes. The author of this hint (Thomas Tempelmann) is the author of that application. However, because there's good information here in the hint, and because the app itself is free and seems to work well, I felt it was worth sharing. Read on for the discussion...]

Logging tools

First the "pro" method: Use a file system logging tool to trace all file operations during a period of time. The problem with these tools, though, is that you might see much more information than you want. Sorting out what's relevant may need some experience and/or patience.

For Terminal-savvy users, the tools of trade are: fs_usage and fslogger. I'll not go into detail here, as they require some reading, and there are man pages available. There's also fseventer, which provides a graphical user interface to fslogger. However, it doesn't offer convenient filters, so you'll usually get much more information than you seek.

Regardless of the tool used, the workflow is as follows:
  1. Start the logging tool
  2. Install the software
  3. Stop/pause the logging tool and analyze its output.
Searching for modifications afterwards

Another alternative is to use my program, Find Any File (FAF), which allows you to search for recent file and folder changes on your disk. Again, this might show you more items than just those of an install process, but the hierarchical view in FAF's results window should make it easy to see which folders and changes are related to the installation.

The workflow is as follows:
  1. Note the time when you start the application installation.
  2. Once the installation has finished, launch Find Any File, and change its search criteria to something like: Modification Date -- is within the past -- X minutes, replacing the "X" with the amount of time that passed since you started the installation.
  3. Hold down the Option key, which changes the Find button to Find All, then click the Find All button, which will relaunch FAF in root mode (and ask for your admin password) and start searching all areas of your hard drive.
  4. Once you see the results window, switch to the hierarchical view (Command-2) to see which folders have changed items.
  5. Repeat the search process for files with a recent Creation Date
Note: The are many other find tools similar to Find Any File, but FAF has the ability to search in root user mode, making it possible to find even such files that may be protected or hidden to the "normal" user.


None of the above options are perfect. The file system logging technique is safer than using a search tool (which still can be fooled if an installer resets creation dates of files and folders). I sometimes like to know what gets installed in my system, especially if it's an installer that asks me for my admin password. Usually, the "find" technique is sufficient, but if you really need to know every detail, go the logging route.

I think the best way to see which files get modified or installed by an app or its installer is to develop a special application which is based on fslogger or fs_usage, and which pays attention only to modifications invoked by the targeted app or its installer. A unix whiz may even be able to get this working just with fs_usage (it has quite a few helpful filters for this), but I imagine something with an easy-to-use UI. Any takers?
  • Currently 2.89 / 5
  You rated: 1 / 5 (19 votes cast)

Find files created or modified by an installer | 20 comments | Create New Account
Click here to return to the 'Find files created or modified by an installer' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Neither of these solutions is ideal
Authored by: lincd0 on Jan 05, '10 08:05:59AM

If you want to know what changes an installer has made to the filesystem, you should take a snapshot before the installation and another one after, and compare the two.

There are many ways of doing this. The easiest is to use an application such as Uninstaller. A more comprehensive solution is to use Radmind, which uses checksums instead of modification dates to detect changes, and can actually revert the changes. But setting up Radmind is too difficult for most users.

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: solitario on Jan 05, '10 08:23:26AM

Though it is not a fool proof method, you can use pkgutil --lsbom or pkgutil --files to list the files in the bom file for a package installed by Apple's Software Installer.

This will not be accurate if for example:

  • The installer creates files during installation (through a installer script)
  • The program creates files on first run
  • The program updates itself later on

Also note that several packages may own the same files (when updates are installed).

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: llee on Jan 05, '10 08:44:08AM
File Buddy's Snapshot feature is useful for this sort of thing (Skytag Software).

[ Reply to This | # ]
Authored by: sapporo on Jan 05, '10 08:55:35AM

I haven't tried this, but it should be possible to just make a backup using TimeMachine before and after the installation, and then inspect the contents of the incremental backup.

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: Crazor on Jan 05, '10 09:04:36AM

fs_usage to the rescue ;)

Just open up your installer, run sudo fs_usage Installer and then continue installing. Add some fancy filter options (see man fs_usage) and/or some intelligent grep's (like grepping for mkdir etc.) and there you go.

[ Reply to This | # ]
Command + I once the installer is running
Authored by: Frizull on Jan 05, '10 09:40:18AM

Once an Installer is open (you don't even need to go through with it), you can press Command + I to show a list of every file and folder it is going to create. I don't know what happens when the files are to be overwritten or deleted, but it is quite thorough otherwise.

[ Reply to This | # ]
Command + I once the installer is running
Authored by: TonyT on Jan 05, '10 03:48:47PM

Now THIS should be a hint! Thanks.

[ Reply to This | # ]
Command + I once the installer is running
Authored by: TvE on Jan 06, '10 02:48:33AM

I have used that functionality a lot for several years ;-)

It still does not show shat happens in the postflight script

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: Dr. T on Jan 05, '10 11:24:13AM
The snapshot comparison methods seem best. Not all installers or updaters follow Apple's rules. Some modify files without altering the modification dates. Some installers don't use packages, so the package inspection methods won't work.

Also, some applications have built-in "installers" that write files and/or modify files the first time the application is launched. If you are concerned about installations, then you should monitor the installation and the first launch.

[ Reply to This | # ]
Another (free) program for this ...
Authored by: BryanD on Jan 05, '10 11:53:38AM

There's also FileControl (see the "Free Stuff" box in the left sidebar).

How To:

  • run FileControl
  • do install and start/quit application once (to get any files that are created when the application is first run)
  • run FileControl to see filesystem differences

Yes, it's a little "old technology" (i.e., it doesn't take advantage of the filesystem events stuff), but it works for this purpose (and others).

If some developer wanted to take this application and update it, we'd consider making the code available (contact me via the site's contact form).

[ Reply to This | # ]
Another (free) program for this ...
Authored by: metiure on Jan 06, '10 12:55:30PM

FileControl is not free...

[ Reply to This | # ]
'scuse Me!?
Authored by: BryanD on Jan 06, '10 04:51:09PM
I should know whether our software is free or not ... and I can assure you that FileControl is free.

[ Reply to This | # ]
Another (free) program for this ...
Authored by: BryanD on Jan 06, '10 04:56:23PM
Contrary to metiure's posting, FileControl is free (I should know, it's our software!)

[ Reply to This | # ]
Another (free) program for this ...
Authored by: scott997 on Jan 10, '10 04:42:02PM

It may be free. But I cannot get it to run. It keeps asking to re-install. There is a problem with the license.

The program looks good if it would run.

[ Reply to This | # ]
Another (free) program for this ...
Authored by: Endorphinity on Jan 14, '10 02:34:08AM
Sorry, Brian, but you are telling only a part of truth. It is a trialware, and the supplied ReadMe file is quite clear in that, the excerpt is below:

"Evaluating FileControl

When you first install and use FileControl, it will be running in Trial mode where it has the following limitations:

    FileControl will only process 5,000 items (folders + files)

    FileControl will not show the deleted items (i.e., only new and changed items will be shown)

    the Trial will expire 4 weeks after being installed

FileControl will remind you of these limitations, when applicable.

Purchasing FileControl

When you are satisfied that FileControl has value, you can purchase a license for FileControl via We use the fine e-store services provided by Kagi. When you receive your License ID from Kagi (via the "Thanks for your purchase" email), you can license FileControl as indicated below."

[ Reply to This | # ]

Find files created or modified by an installer
Authored by: Aeschylus on Jan 05, '10 04:59:37PM

Another benefit of the Find Any File method is that you are getting an incredible file finding program as a bonus. It is really fast and does complete searches with great filtering and displays.

All of these hints are useful; but it seems that Apple should require the installer to supply complete logging of what's put where. It's already 2010, and the Jetson's have automatic tooth brushers and flying cars. Why can't we at least have this?

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: mm2270 on Jan 05, '10 07:26:10PM
Two comments about this-

1) If you're running a .pkg or .mpkg based installer, as mentioned above, simply use the Show Files command once the installer has launched to get a good idea of what will be installed and where.

2) If you're dealing with a non package installer, download a free copy of LANRev InstallEase and do a before and after snapshot and will present you with a nice hierarchical list of what got installed and/or modified.

One thing to keep in mind with snapshot capture tools like InstallEase though, is that these utilities have no way of knowing if an installer placed or changed a file on the system or if another running app did. It just does a diff and comes up with a list. For ex, Safari cache and pref files, Finder and dock prefs, files in /tmp and other stuff may end up showing up. A little common sense can help you weed those out of the mix though. In my experience with pkg creation from non-pkg installers, I've rarely see an installer change anything under the /Users/YourHomeFolder location. Most of the time a running app will be the one making changes there, such as Mail or an Entourage db changing size.

[ Reply to This | # ]
Use Xray mode...
Authored by: slb on Jan 06, '10 07:16:34AM

From a previous hint:
To turn this on, quit the Finder (using Activity Monitor, Terminal, etc.), then open Terminal and enter this command:
$ defaults write QLEnableXRayFolders 1
Relaunch the Finder, and enjoy the new folder X-Ray mode in Quick Look. If you ever want to disable it again, quit the Finder, then repeat the above Terminal command, but change the 1 to a 0.

Now, spacebar-click on (most, not all) .pkg or .mpkg file to see what it will do.


[ Reply to This | # ]
Use Xray mode...
Authored by: asmeurer on Jan 07, '10 12:57:22PM
Suspicious Package is a nice Quicklook plugin for installer packages.

[ Reply to This | # ]
Find files created or modified by an installer
Authored by: mrwarmth on Jan 07, '10 10:51:47PM

What about just a quick snapshot and after snapshot software... no installers just check system after any event... is there an app to easily lay it out? I have tried to use filecontrol but it asks for me to "re-active" my license so no luck there... I think it was made freeware but nobody remembered to change the policy it seems. Anyhow I am looking into file buddy, but any other good ideas? All of the above are excellent BTW so thanks for taking the time to post, I am trying each of them individually to determine the best app for my needs.

Fseventer good for doing all this? I thought it was but nobody mentioned it so I guess everyone is just talking installers.

[ Reply to This | # ]