Comments on: Can You Lock/Watch your sysyem?

Question: Can You Lock/Watch your sysyem?

Napierzaza — Sun, 10 Sep 2006 13:27:34 -0800

Is there anyway to boot your mac off a disk image? Or something that can be closely watched in terms of changes?

I want to be able to have my system inside a single (not necessarily compressed) file that I would be able to us diff on or something. I want to be able to track every change in my system folder very closely to see what has been installed on it. Perhaps there is a extension or utility that might do this without loading of a .dmg?

By: kindall

kindall — Sun, 10 Sep 2006 13:41:20 -0800

The only way I'm aware of to boot from a disk image is to put the disk image on a Mac OS X server and boot over the network.

As for getting diffs of directory changes, why not just periodically do ls -alR /System >foo.txt and diff that? You could put it on a cron job.

By: crypticgeek

crypticgeek — Sun, 10 Sep 2006 13:43:31 -0800

You could use a host based intrusion detection program to monitor files for any changes. Tripwire is what I'd use. Unsurprisingly, there is an OS X patch for it over here.

By: cillit bang

cillit bang — Sun, 10 Sep 2006 13:58:55 -0800

You could get the effect by creating a small partition on your hard disk to boot off. Make a disk image of the partition before and after and diff them.

By: Malor

Malor — Sun, 10 Sep 2006 15:40:23 -0800

You might want to ask this on a more technical Mac forum. Spotlight has the ability to monitor all files on the disk for changes; that's how it's able to update itself live without visible performance loss. I think there is a method to hook into this facility with user programs, but I don't know what it is offhand.

By: mrg

mrg — Sun, 10 Sep 2006 15:59:40 -0800

FSLogger? This uses the Spotlight hooks that Malor suggested. otherwise, the ls trick above would be good too.

By: jaimev

jaimev — Sun, 10 Sep 2006 17:26:26 -0800

How about the mtree command? Check out this Macdevcenter article on it's use for detecting presence of rootkit files under OS X.

By: machaus

machaus — Sun, 10 Sep 2006 21:12:28 -0800

There's a shareware utility called Filebuddy that lets you take snapshots before and after a software install in order to see what was changed.

By: flabdablet

flabdablet — Mon, 11 Sep 2006 05:32:09 -0800

Seconding tripwire. Been around forever, works well.