I want to spy on an OS X installer to find out what files it's leaving on my computer. Can I?

July 26, 2008 10:51 AM

Is there a program for OS X which can monitor *exactly* what an installer does, so that I could find out every file or setting it's modifying?

I've a Fuji Scansnap 5100OEX2 scanner that I use with my MacBook. Like a fool, I installed the latest driver update. It doesn't work well for me at all. When I deleted it (according to Fuji's instructions) any attempt to re-install the older, better driver fails because it insists that a newer version still exists on my computer.

I've checked everywhere I can for hidden files left behind by the newer driver, etc. I'm at a complete loss, and my scanning has ground to a halt.

Is there a program I might use which could monitor *exactly* what the installer does, so that I could install the newer driver again and find out which file or setting it's modifying such that even after it's supposedly deleted, the old driver "knows" that the newer driver was once on my machine?

posted by alaaarm to computers & internet (10 comments total)

Bill of Materials files are a good first place to look. They are in /Library/Receipts/
posted by thedaniel at 11:14 AM on July 26, 2008 [1 favorite has favorites]

Use the Console, in Utilities. All the logs are find/search/understandable from there.
posted by rokusan at 11:21 AM on July 26, 2008

I would think you could run fs_usage (as root) in the terminal before starting the installer and then go over the results. You'd want the terminal to have a pretty large buffer for some cases.
posted by kimota at 11:35 AM on July 26, 2008

If you're in the installer program, File -> Get Info will tell you what files are going to be installed.
posted by trouserlouse at 12:09 PM on July 26, 2008

sudo fs_usage Installer >~/logfile.txt
posted by kindall at 12:31 PM on July 26, 2008

The program you want is fseventer. First, quit any background processes that might write to disk, in order to reduce the noise. Then, fire up fseventer and press 'play' before beginning the install. Stop it once the install is done. Fseventer will track and nicely document every single change to the filesystem, so that you can hunt down those little that bits the installer leaves in unexpected places.
posted by mumkin at 1:47 PM on July 26, 2008

$ sudo su - 
# cd /
# find / > /tmp/before

 (install your program)

# find / > /tmp/after
# diff /tmp/before /tmp/after

posted by popechunk at 2:20 PM on July 26, 2008

Maybe pipe those find commands through sort.
posted by popechunk at 2:22 PM on July 26, 2008

pacifist Lets you delve into install packages. Don't know if it will get into vise installers, but any standard mac installer, Pacifist will let you see where files go (and selectivly install those files too) It's saved me several times.
posted by johngalt at 3:28 PM on July 26, 2008

Thank you, everyone, for the excellent suggestions. One of the simplest solutions -- checking for and deleting the package receipt -- worked like a charm. I'm back to scanning away, about which I'm very appreciative since I'm trying to kill the contents of my filing cabinet prior to moving overseas in a week!
posted by alaaarm at 10:01 AM on July 27, 2008