HN Explorer

Ask HN: Tool that lets you identify changes an app makes to the disk?

5 points by jfdi ↗ HN
Similar to using the time command ($ time <app>) in a shell to see duration of execution, I wondered if there's something that will be similarly executed and give you a read-out of the changes an app makes to disk.

5 comments

[ 3.9 ms ] story [ 18.1 ms ] thread
wmf
DTrace?
erikig
Here are some suggestions:

If you are on *nix you can list all the files that a process is using: $ lsof -p <PID>,<PID>,<PID>

Then do a diff of the listed files against older versions of the files (e.g from a backup).

On Windows you can use procmon.exe (its a free tool from Microsoft that lists all network, registry and files) and see the updates in realtime.

Hope those work.

dantheta
strace can do it (Linux). Watch out for "open", "read","write","unlink" in the output - these are some of the filesystem operations.

inotifywatch (from inotify-tools) can show you changes made to files in a particular directory.

jfdi
Thanks guys this is a great starting point. I'll try each out and see how what works best. If I discover anything interesting I'll put a blog post up outlining in case others run into the same.