Tracking Changes to the OS X File System

I was troubleshooting a problem today related to the use of parental controls in OS X 10.5 Leopard and form post-processing in Firefox when I made use of some rare (for me) but helpful set of UNIX terminal commands used to detect and view modifications to system files.

To offer context, we learned today that Firefox "bonks out" when parental controls are enabled in Leopard. People logged in under our limited student account were unable to authenticate to various Web sites, post text in blog spaces, etc. using Firefox. Not surprisingly, everything worked just peachy in Safari (isn't that a hoot?). After knocking our heads against the wall we determined the issue is probably related to the way Leopard's parental controls handle access to proxy services, and there is no fix (as of this post) except to use the Safari browser (yuck), manage everything using Workgroup Manager (not practical in our case), or disable Parent Controls altogether. Lovely.

Anyway, this exercise in futility was not a total loss because I re-learned how to search and find system files accessed (i.e. modified or read) during a specific time period.

For example, to see all the files that changed during a process (such as installing an application), create a timestamped file to use as comparison in the Terminal using touch and run the following find command:

$ touch ~/Desktop/Before.txt

do something...

$ sudo find / ~type d -cnewer ~/Desktop/Before.txt > ~/Desktop/After.txt

This creates a file named "After.txt" on the Desktop that lists all changes made to system files since you created the file "Before.txt."

Or, you can use the following command to search for files in your home directory that were modified exactly 2 minutes ago (or any time since):

$ find ~ -mmin -2 \! -type d

Pretty nifty! There is also a command-line program available called logGen which can be used to track changes to OS X system files modified during package installs. This tool comes in handy when creating personal .pkg installations using IceBerg or Apple's PackageMaker developer tool. I've had better luck creating successful package installations with Iceberg than with PackageMaker. Since I'm on the subject, I should mention another essential tool every Mac "techie" should be familiar with named Pacifist, a great little shareware application created by CharleSoft that can be used to peek inside Mac OS X packages, extract individual files and folders, and find missing or altered installation files.