Tracking filesystem changes in macOS; #

or, Monitoring app installers/activity:

Carbon Copy Cloner & Beyond Compare

  1. Clone entire boot volume with Carbon Copy Cloner 5 (or 6 via Legacy Bootable Copy Assistant)

  2. Install or run app

  3. Repeat step 1

  4. Compare clones with Beyond Compare in a root session: sudo /Applications/Beyond\

Local Time Machine snapshots & Beyond Compare

  1. Create a local snapshot:1 tmutil localsnapshot

  2. Install or run app

  3. Repeat step 1

  4. Find snapshot names: tmutil listlocalsnapshots /
  5. Create mount points and attach snapshots:2

    % mkdir ~/snapshot1 ~/snapshot2
    % mount_apfs -o ro -s /System/Volumes/Data ~/snapshot1
    % mount_apfs -o ro -s /System/Volumes/Data ~/snapshot2
  6. Compare snapshots with Beyond Compare as above

  7. Unmount snapshots and optionally delete mount points (~/snapshot1 & ~/snapshot2) and snapshots (e.g., tmutil deletelocalsnapshots 2023-10-16-184247) when done.

Live monitoring

Static PKG installers

Legacy apps



  1. Time Machine backups exclude a number of files and folders and others may be excluded via the com_apple_backup_excludeItem extended attribute (uncover them via sudo mdfind "com_apple_backup_excludeItem = ''"). 

  2. Grant Terminal Full Disk Access to avoid mount_apfs: volume could not be mounted: Operation not permitted

/mac | Oct 17, 2023

Subscribe or visit the archives.