How can I track the changes an installer makes?

Standard OS X Installer packages can easily be viewed. One tool for this is Suspicious Package, a QuickLook plugin that shows files and scripts contained in the Installer package.


While installing, you can monitor file system accesses using tools like opensnoop or fs_usage (both command line utilities).


You can show the files that would be copied by an installer by pressing command-I:

Or with lsbom:

$ lsbom ~/Desktop/KeyRemap4MacBook.pkg/Contents/Archive.bom
.   40755   501/20
./Library   40755   0/0
./Library/LaunchAgents  40755   0/0
./Library/LaunchAgents/org.pqrs.KeyRemap4MacBook.server.plist   100644  0/0 485 2125025754
...