Command line and power tools

Tracking what an app wrote

Updated 2026-07-31 · 4 min read

Useful for troubleshooting, for uninstalling properly, and for satisfying yourself that something did what it claimed.

After the fact

find / -newermt "10 minutes ago" -not -path "*/Caches/*" 2>/dev/null | head -60

-newermt takes a natural date. Expect system noise; the meaningful lines are usually in /Applications, /Library, ~/Library and /usr/local.

Live, while it happens

sudo fs_usage -w -f filesys | grep -i appname

fs_usage prints every filesystem operation as it occurs. It is a firehose — filter hard. Terminal needs Full Disk Access for this to be useful.

Watching one directory

sudo fs_usage -w -f filesys | grep "/Users/you/Documents"

What an installer package will do, before running it

pkgutil --expand installer.pkg /tmp/expanded
ls -R /tmp/expanded

That reveals the payload and any preinstall/postinstall scripts. Reading those scripts before running an unfamiliar .pkg is a reasonable habit.

Afterwards, list what a package actually placed:

pkgutil --pkgs
pkgutil --files com.example.package

Console

Console.app with a filter on the app's name shows what it logged, which frequently includes the paths it wrote.

Why this is hard to do with search

Almost everything an app writes goes into ~/Library, which Spotlight excludes. The Terminal is the practical route, or an index that does not exclude Library and can sort by modification time.

Common questions

What is fs_usage?

A built-in tool that prints filesystem activity in real time. It needs sudo and Full Disk Access to be useful.

How do I see what a .pkg installed?

pkgutil --pkgs lists installed package IDs; pkgutil --files <id> lists their files.