What files are accessed when an app starts up?

I am wondering if there is a way to see which files an application accesses (reads or writes) when starting up.

/usr/bin/fs_usage seems like one tool, but I wondered if there are others.

I am trying to make it easy to copy preferences between two computers, and I figured that this was one step approaching that goal, but I'm interested in the question for several reasons. I know preferences are usually kept in ~/Library/Preferences/ and ~/Library/Application Support, but how do I find out which files/folders specifically?

Solution 1:

I think there's a couple of options. You could use a launchd script with a WatchPaths property that triggers on those directories.

You can also use the command-line tool lsof to list open files of a process.

You can inspect open files per-process using Activity Monitor. If you click on the process and click "Inspect", it should bring up additional information. One of the tabs here should be for open files (see below).

Solution 2:

When I'm curious about things like this, I immediately turn to fseventer. It is essentially a GUI for fs_usage, and simply presents a list of files as they're being modified/created/deleted. In the default tree view mode, you good a nice hierarchy of files modified and their paths. In tree view, you can hover over a file or directory with a red (i) icon over it and see which application touched it.

Over in the second tab (grid mode), you can easily see which files were modified by an application. Screenshots of each of these are on fseventer's homepage.

There are a lot of nice options to tailor the output to exactly what you need, such as when (if ever) files should disappear from the list, various output views, and a few more nice-to-haves.

fseventer is free, donations-suggested; some people call it "nag-ware" because you have to dismiss a donation dialog on application start.