The name of the folder is given in System Preferences » Desktop & Screen Saver » Screen Saver. If that is not enough to locate it, you have two options:
- Decode the encoded data specifying where on the file system the folder is located
- Monitor file system accesses while images from that folder are displayed.
Decode the data
The location is stored in
* being a UUID.
Now run the following command in Terminal:
/usr/libexec/PlistBuddy -c 'Print moduleDict:fileRef' $( ls -t ~/Library/Preferences/ByHost/com.apple.screensaver.*.plist | grep -v slideshow | head -n1 ) | grep -oaE 'file://[^[:cntrl:]]+/'
This will first get the most recent
com.apple.screensaver.*.plist file that does not contain
slideshow in its name and read its contents: the relevant entry of the property list file is
Now the return value (much binary data) is filtered for a file URL. This is printed. On my system, it looks like this:
The path, of course, is
Monitor the file system
Open System Preferences » Desktop & Screen Saver » Screen Saver and select the folder you want to locate to see a preview.
Now, while leaving this window open, open a Terminal window and run the following:
sudo opensnoop | grep -v '/.vol' | grep "System Pref"
Enter your password, and wait. It will print the paths to the image files as they are loaded (when one file is being displayed, the next one is already loaded). Some of the files that are listed are false positives, but they should be easy to recognize:
501 77313 System Preferen 16 /Users/danielbeck/Pictures/Icons/fugue-icons-2.0/icon/contrast-small.png
501 77313 System Preferen 16 /Users/danielbeck/Pictures/Icons/Crystal Clear/22x22/actions/ok.png
501 77313 System Preferen 16 /System/Library/ColorSync/Profiles/sRGB Profile.icc
501 77313 System Preferen 16 /Users/danielbeck/Pictures/Icons/GNU Lesser General Public License/nuvola/64x64/mimetypes/tgz.png
501 77313 System Preferen 16 /Users/danielbeck/Pictures/Icons/crystal_project/32x32/devices/pipe.png
Use this to locate the path to the pictures folder.