MacOS – n attribute that can show which process created a file

macosuti

Now, I can find out which processes are opening files dynamically. However, for a file on my filesystem, is there a way to find out which process created the file?

I'm trying to differentiate a file I created by:

touch(1)

from one created by say, an NSAPI process running under my id.

lastcomm(1)

will give me information such as which tty is doing something, is that an attribute I can access?

Essentially, my id does a bunch of stuff. Much of what my id does should be via applications, or from a terminal. I'd like to find out more. Suggestions?

Best Answer

Darwin is open source. I'm guessing you'll need to modify OS level things, a kernel extension, etc. and add this ability.

Or you could modify the dynamic-view tools you know (fs_usage and/or lsof), have them check if a file is being created, and append the process chain that created it into the Spotlight comment, etc.

Related Question