Identify ALL newly installed files

[kkinto]

Hi - is there a way to see every single file that an installer installed on your mac? Or alternatively a way to list every single file in order of creation/modification so one can see what has changed?
Dates do not seem reliable as many installed files have old creation/modification dates that seem to be the ones listed in the Finder.
This would apply to everything installed anywhere on the startup drive, including "above" the user folder.
Thnx

 

[Slartibart]

You can use e.g. Pacifist to look into a variety installer or compressed files and check the scripts, structure, etc.

If the standard installer is used, you can use the the "Show Files" command (⌘ + i) after it opened when clicking a package.

For standard installer packages you can use pkgutil --payload-files whatever-installer.pkg or pkgutil --only-files --files whatever-installer.pkg or pkgutil --only-dirs --files whatever-installer.pkg in the terminal.

 

[bogdanw]

A free alternative to Pacifist - Suspicious Package https://www.mothersruin.com/software/SuspiciousPackage/
Discussion about pkg installers https://forums.macrumors.com/threads/pkg-uninstaller-made-on-a-zsh-shell-script.2423127/

 

[Fishrrman]

If you want to monitor every file that has been created at/after a certain date/time, you can use the FREE utility called "Find any File" to do this.

Get it here:

Find Any File

findanyfile.app

Then set it up similar to this:

One proviso:
It will find ALL files created after that time, not just files related to a specific app install. But some apps are "sneaky" about files that they create, particularly demo versions of software that install "hidden" files to stop the demo from running after a particular length of time...

 

[bogdanw]

If you want to monitor every file that has been created at/after a certain date/time, you can use the FREE utility called "Find any File" to do this.

Great app, but, created date is not the best filter for this task. Files in the pkg can be created days, months or even years before.
Date added would be best for this kind of search.
Example, MicrosoftEdge pkg downloaded today (24) installs Microsoft Edge.app with created date as 18 July 2024.

 

[kkinto]

You can use e.g. Pacifist to look into a variety installer or compressed files and check the scripts, structure, etc.

If the standard installer is used, you can use the the "Show Files" command (⌘ + i) after it opened when clicking a package.

For standard installer packages you can use pkgutil --payload-files whatever-installer.pkg or pkgutil --only-files --files whatever-installer.pkg or pkgutil --only-dirs --files whatever-installer.pkg in the terminal.

Thanks for the suggestions. I looked at Pacifist and its great for looking at actual installers. But its often these installers that install another installer and then that begins downloading files from the Internet to install!

Find Any File sounds awesome. I will check that out as Spotlight is not useful at all when it comes to the entire disk.

 

[bogdanw]

"Sloth is a native Mac app that shows all open files and sockets in use by all running processes on your system. This makes it easy to inspect which apps are using which files and sockets."
https://sveinbjorn.org/sloth

 

[f54da]

You could use fs_usage or opensnoop to log all file-system activity from a point in time forward