File metadata.json Appears on Desktop in macOS

macos

I apologize if this is impossible to debug, but this has been happening on my Mac with macOS Sierra 10.12.2 installed since a few weeks and I thought I'd give it a shot.

Basically, a metadata.json file gets automagically created on my desktop. I delete it. It appears again after a while. GOTO 1.

Google gets a bit mixed up when I search for answers.

So, how would I begin to find out which app is the culprit?

Edit: this is the file contents (duh!):

{"name":"Desktop","modificationTime":1484074718317,"categories":[]}

metadata.json file on desktop

I run the suggested command and I got this:

501    788 Sketch        -1 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    356 bird          25 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    788 Sketch        29 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    22 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    22 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    720 mdworker      10 /Users/ignacio/Desktop/metadata.json
dtrace: 2154 dynamic variable drops with non-empty dirty list
  501    908 Sketch        -1 /Users/ignacio/Desktop/metadata.json
  501    356 bird          25 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    908 Sketch        18 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    718 mdworker      10 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json

Best Answer

You can use opensnoop to see what app writes to that location.

sudo opensnoop | grep metadata.json

To disable System Integrity Protection, you can do the following:

  1. Boot into the Recovery HD by restarting whilst holding ⌘R.
  2. Open Terminal (from the Utilities menu).

  3. Run the following command in Terminal:

    csrutil disable
  4. Restart.

Source: Disable OS X El Capitan Rootless and permit write actions to System Integrity Protection locations

Related Question