Search code examples
macosstorageuninstallation

How to know which files does a MacOS app generate/store on system?


I am going to build an app that can uninstall other apps completely. Similar to the Uninstall Apps available in Parallels Toolbox. Now the question is how do I trace and locate every file/folder that a particular app generated/stored on my system?

The app can be coded in Shell, Swift, C/C++


Solution

  • This is a hard problem, especially on modern systems like MacOS. One could run the third party installer using a tool like DTrace to look for kernel level calls that create or write to files. That would give you some idea of what the installer is doing.

    A complexity comes from violating one of your implicit assumptions, which is that creating/modifying files comprises the only activity the installer is engaged in, which may not be true. In Windows, for example, installers can modify the registry, which requires a different detection and rollback mechanism. (I know you're targeting MacOS specifically, but consider it an analogy.) Many installers will access OS-level services, which are separate processes that maintain their own state, which can be incremental and "opaque" to a naive onlooker (e.g., a modification to a SQLite database file).

    One approach might be to create a sandbox with snapshot capabilities and a stripped down version of the target OS (i.e., with as few services running as possible). In theory, one could take a snapshot just before running a third party installer and just after, then see what's changed between the two. From there, one could write a program that approximated a rollback of as many of those changes as practicable, but that would still likely require human judgment to read the tea leaves of the snapshot (i.e., ignoring changes to things like /var/log/... files, etc.) and translate that into something one could run repeatedly and reliably to effectively reverse the installation.

    That being said, it's still an interesting problem to research and think about. It's also an excellent way to learn a lot about operating systems, and you may discover some tricks or approaches which substantially challenge the assumptions I've laid out here. For example, after a few observations, you might be able to generate a pretty good set of heuristics for both detection and rollback that apply to many common installers in use today. I encourage you to keep learning and thinking about this.