4

Just wondering if there's a free software for mac that checks which files are opened/read or written during the execution of a given software and return them like a three graph. I'm sure I saw something similar in past but I can't remember its name.

Thanks in advance!

3 Answers 3

3

You may be thinking of fseventer, but it only shows changed files (not those just being read), and shows all changes not just those by a specific program.

Other possible not-quite answers: in Activity Monitor, you can "inspect" a process and (if you own it) see what files it has open. In Terminal, you can use the lsof command to list files opened by all of your processes (if you're an admin, you can use sudo lsof to see processes you don't own). Also check out the Terminal commands fs_usage, filebyproc.d, opensnoop, and rwsnoop. Finally, if you have Xcode (Apple's developer tools suite), check out Instruments.

2

fseventer also has an option to include files that are just opened:

opensnoop prints files opened by processes:

sudo opensnoop -n processname
0

For me on macOS Ventura, opensnoop was not really working, however lsof did the job.

top -l 1     #find the process ID of the FortiClientUpdater
sudo lsof -p 18592     #look for a suspicious entry, in my case the last one
open /private/var/folders/w3/my9vhvh48xjb4h0059bc_ssh0000gn/T/fctupdate/obj_1_TGiK3k

There it was, the temporary location of the installer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .