Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not really familiar with Mac at all, but I have a friend who has this issue (she's a mac person, but not a computer person), so thought I would give it a shot.

The problem is that she has some old pictures that show up in her screensaver rotation - she really wants to save them/back them up, but we don't seem to be able to find them on her computer.

They aren't in iPhoto, and a search for all images on her box doesn't turn them up.

Looking at the system properties for the screensaver slideshow, you can see a listing of the pics, but there is no way to tell where they are stored (at least that I could find). Click and double click just open it in a little window, I can't right click with her mouse, and I tried all the symbol-clicks I could see on the keyboard - no love.

Can anyone tell me where the pics in the screensaver rotation are stored, and why they might not show up in a full computer search for all images?

share|improve this question
up vote 4 down vote accepted

The name of the folder is given in System Preferences » Desktop & Screen Saver » Screen Saver. If that is not enough to locate it, you have two options:

  1. Decode the encoded data specifying where on the file system the folder is located
  2. Monitor file system accesses while images from that folder are displayed.

Decode the data

The location is stored in ~/Library/Preferences/ByHost/*.plist, * being a UUID.

Now run the following command in Terminal:

/usr/libexec/PlistBuddy -c 'Print moduleDict:fileRef' $( ls -t ~/Library/Preferences/ByHost/*.plist | grep -v slideshow | head -n1 ) | grep -oaE 'file://[^[:cntrl:]]+/'

This will first get the most recent*.plist file that does not contain slideshow in its name and read its contents: the relevant entry of the property list file is moduleDict:fileRef.

Now the return value (much binary data) is filtered for a file URL. This is printed. On my system, it looks like this:


The path, of course, is /Users/danielbeck/Pictures.

Monitor the file system

Open System Preferences » Desktop & Screen Saver » Screen Saver and select the folder you want to locate to see a preview.

Now, while leaving this window open, open a Terminal window and run the following:

sudo opensnoop | grep -v '/.vol' | grep "System Pref"

Enter your password, and wait. It will print the paths to the image files as they are loaded (when one file is being displayed, the next one is already loaded). Some of the files that are listed are false positives, but they should be easy to recognize:

501  77313 System Preferen  16 /Users/danielbeck/Pictures/Icons/fugue-icons-2.0/icon/contrast-small.png 
501  77313 System Preferen  16 /Users/danielbeck/Pictures/Icons/Crystal Clear/22x22/actions/ok.png 
501  77313 System Preferen  16 /System/Library/ColorSync/Profiles/sRGB Profile.icc 
501  77313 System Preferen  16 /Users/danielbeck/Pictures/Icons/GNU Lesser General Public License/nuvola/64x64/mimetypes/tgz.png 
501  77313 System Preferen  16 /Users/danielbeck/Pictures/Icons/crystal_project/32x32/devices/pipe.png 

Use this to locate the path to the pictures folder.

share|improve this answer
Or fseventer, if that's easier ;) – slhck Jun 18 '12 at 19:27
@slhck One-liner in bash! osascript -e "tell application \"Finder\" to { activate, display dialog \"$( echo -e "$( /usr/libexec/PlistBuddy -c 'Print moduleDict:fileRef' $( ls -t ~/Library/Preferences/ByHost/*.plist | grep -v slideshow | head -n1 ) | grep -oaE 'file://[^[:cntrl:]]+/' | sed 's/+/ /g; s/%/\\x/g' )" | cut -c8- )\" }" 2>/dev/null || true – Daniel Beck Jun 18 '12 at 19:31
Heh. Have I ever told you you're crazy? – slhck Jun 18 '12 at 19:54
Perfect - Thanks! – Eli Jun 18 '12 at 21:16
@DanielBeck - Thanks very much for sharing the opensnoop method. Worked instantly in OS X 10.9 and 10.10, and in 10.11 after disabling SIP (Recovery Mode > Terminal > csrutil disable; reboot). – Miles Wolbe Apr 16 at 6:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.