Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many programs refuse to go beyond a trial period. Even if they are trashed and then reinstalled, they 'remember' that the trial period has expired. Assuming no contact with a licensing server, what is the general way that most copy protection works? Do programs drop files in random folders on the hard disk that are hard to track down? I know there's no registry on OSX/Linux, but perhaps something similar... ? Or must it be a file/folder?

I'm actually not curious from a hacking side but rather from the implementation side, but in any case the question is basically the same.

share|improve this question

Usually they use files located somewhere on the hard drive.

In OSX most programs either use the preference file in /Library/Preferences/ or a folder in /Library/Application Support/.

Of course there are applications that try to hide those files, but if someone is determined to break misusing of the trial periode hiding a file isn't effective.

share|improve this answer
Interesting. If I were more curious, I would make/find a program to do before/after comparisons of file structures. – Dan Rosenstark May 25 '10 at 18:44
There is actually, but I don't have a link handy. – Josh K May 25 '10 at 18:56

Most of the time OSX stores files in the following:

  • ~/Applications/
  • ~/Application Support/
  • ~/Library/Preferences/
  • ~/Library/Preference Panes/
  • /Library/Application Support/
  • /Library/Preferences/
  • /Library/Preference Panes/

There are several applications (see How to uninstall software on a Mac) that will scan these folders and check for any files relevent to that application.

share|improve this answer
In those folders, or "somewhere underneath" those folders? – Dan Rosenstark May 26 '10 at 9:06
Right, and being that timestamps can be arbitrary, they'd have to found by "watching" the folders or comparing snapshots, I guess... – Dan Rosenstark May 26 '10 at 10:30
You can write files with whatever timestamp you want. The only way to be sure would be to index the folder before and after and compare. – Josh K May 26 '10 at 12:09

Most of the time it's a file or files which is created or changed first time you run a program. Every time you run the program it will look for these files to spot if you have exceeded your test period. By deleting or reverting these files back you can get a new "trial period".

Other systems will make an ID of your machine which is unique for you, then save this ID online. This can be harder to cheat as you will need to change hardware or make the system believe you are a new user.

Some system use both.

The company I work for does copy-protection and maybe this link will be of value: All about copy protection. It's old knowledge, but still legit today.

share|improve this answer
+1 there are multiple ways to implement copy protection, which is clearly communicated in the hyperlinked article. Programmers usually do not try to make things super easy for copy protection breakers, and so they often explore custom approaches. – TOOGAM Sep 29 '15 at 14:55

Some things do it on time, setting a date it won't work after. If you were to advance the date manually on your computer to 2020 and run the program it will set it's "expire by" date to sometime in 2020. Close the program and reset your date to normal and you will have "magically" extended the trial.

share|improve this answer
I know they "do it on time," the question is "how?" – Dan Rosenstark May 26 '10 at 9:05
When you install it, it looks at the current date, adds 30 days to it. Then every time it starts up, it looks to see if the current date is the day of, or after the date it set as the date the trial expires. If so, run the limited version or not at all, if not, run it normally and show the time left. – alpha1 May 27 '10 at 14:01
Just makes a note of the date it expires, and every time you load it, checks to see if the current date of on or after the date it expires. – alpha1 May 27 '10 at 14:02

It varies.

I've often used RegMon and DiskMon to monitor what registry keys and files are accessed by programs. While this is generally useful for debugging or determining how programs work, in your case you could use these programs to determine what exactly the program is accessing locally to determine whether or not its allowed to run.

Here's an OS X equivalent for DiskMon.

share|improve this answer
Could be interesting. I'd have to find OSX equivalents. – Dan Rosenstark May 25 '10 at 18:45
Wow, what a horrible answer - I didn't see OSX/Linux bit. – mindless.panda May 25 '10 at 19:00
Horrible for the purposes of OSX/Linux? Maybe. Useful for everyone else in Windowsland? Absolutely. – Christian Mann May 26 '10 at 3:40
I voted you up and you're still at -1, sorry :) – Dan Rosenstark Jun 2 '10 at 20:43
np - fseventer is a good find - plenty of uses for the future – mindless.panda Jun 3 '10 at 18:49

the app might store some invisible files in Preferences folders.

Some are also shrewd enough to store info in .DS_Store files.

share|improve this answer
interesting, +1......... – Dan Rosenstark Jun 2 '10 at 20:53
or broken if in .DS_Store files - hey can get deleted (well I do) – Mark Jun 14 '10 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.