MacOS – ny way to review all file moves done with Finder

catalinaconsolefindermacbook promacos

I recently setup a new Macbook. I had a few apps open, and noticed all of a sudden a Finder dialogue window that showed thousands of files being transferred to 'Movies.' I believe it said '…files being copied to Movies.' And it was in the magnitude of 10's of thousands of files.

I quickly cancelled this process because whatever it was, was not intentional. There is nothing now in the Movies folder. And this is a brand new Macbook to which I did not migrate any personal data.

Im now paranoid about what those files were, how that process started, if I have malware, etc.

For my peace of mind I want to see if it's possible to find a log of all activity in Finder that would show details about that unintentional file transfer. I tried looking at the Console application, and system.log file but Im not sure if that's the right place to look.

Best Answer

There’s no need to review since Finder cleans up a bulk move almost always and when it doesn’t - you will see the files sitting in the new location.

One way way to know what changes from day to day is Time Machine, so for your peace of mind, set that up and now you’ll have a reliable measure to track files even if they move / delete and even better - you’ll have a backup and not just a record of what was lost or misplaced.

Related Solutions

macOS – Addressing Time Machine’s Excessive Indexing Time after Upgrading to Lion

I had the same problem after first upgrading to Lion. I erased my Time Machine and it seems to work fine now.

MacOS – Finder hiding specific file by name

Any file or folder that begins with '.' is going to be hidden in the Finder. That has always been true, back to the days of NeXTStep.

If what you are trying to do is automatically rename files that begin with a '.' to not begin with a '.' that can easily be accomplished with a shell script. Save the following as /usr/local/bin/rename-dot-files.sh:

#!/bin/zsh -f

DIR="$HOME/Downloads/"

cd "$DIR"

ls -1Ad \.* | egrep -v '.DS_Store|.localized' | while read line
do

        NEWNAME=$(echo "$line" | sed 's#^\.##g')

        /bin/mv -vn "$line" "$NEWNAME"

done

exit 0

That script will look in $HOME/Downloads/ for any files that start with a . (excluding .DS_Store and .localized which you do not want to rename) and will rename it to the same name, without the '.' as long as there is no other file/folder with that same name.

To do this automatically you will need to create a launchd plist that will automatically launch any time the directory changes:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Disabled</key>
    <false/>
    <key>Label</key>
    <string>com.tjluoma.rename-dot-files</string>
    <key>Program</key>
    <string>/usr/local/bin/rename-dot-files.sh</string>
    <key>RunAtLoad</key>
    <true/>
    <key>WatchPaths</key>
    <array>
        <string>/Users/luomat/Downloads/</string>
    </array>
</dict>
</plist>

Obviously you'll want to change the path from /Users/luomat/ to whatever your $HOME is.

Save that plist to ~/Library/LaunchAgents/com.tjluoma.rename-dot-files.plist and then load it as:

launchctl load ~/Library/LaunchAgents/com.tjluoma.rename-dot-files.plist

The script will run whenever the ~/Downloads/ is changed, which includes any files being added or removed, but it automatically limits itself to files which begin with '.'

Best Answer

Related Solutions

macOS – Addressing Time Machine’s Excessive Indexing Time after Upgrading to Lion

MacOS – Finder hiding specific file by name

Related Question