Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Working on a project to reverse-engineer Mail applications changes to keychain files. Using fs_usage I can see # of bytes written to keychain file, but I am unable to determine dynamically exactly what content is being changed

Thoughts, approaches very much appreciated/

thanks, LightworksGal

share|improve this question
You really should mention your OS on questions like these. From fs_usage, keychain and Mail, I infer Mac OS X, right? – Gilles Dec 10 '10 at 22:27
up vote 1 down vote accepted

ktrace or dtrace will let you see reads and writes to files on OSX (strace is the linux equivalent), among a lot more data you'll need to filter out.

share|improve this answer
Thanks, Sparr! Well answered. – LightworksGal Dec 10 '10 at 7:56
Is there an strace port to OSX? Natively I only know of dtrace. – Gilles Dec 10 '10 at 22:25
@Gilles edited my answer to point to ktrace instead of strace – Sparr Dec 11 '10 at 0:13
There is no ktrace on my OS X 10.6 system. It was replaced by dtrace in 10.5. – mark4o Dec 11 '10 at 0:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .