Non-Apple-provided files in SIP-protected directories

On my macOS Catalina 10.15.1 system, I think I have some files in SIP-protected directories that were installed by third-party (i.e. non-Apple) software prior to SIP being added to macOS.

Is there any way to determine which files in SIP-protected directories weren't provided by Apple?


I use the excellent software Pacifist to tell which files are installed from which source.

  • https://www.charlessoft.com/

You can also just make a new Volume and install a clean version of macOS to see which files result from a clean install with no migration.