Getting old filesystem events - check which process deleted a specific folder

Question

Created Nov ’22

Replies 1

Boosts 0

Participants 2

After macOS minor upgrade of Monterey I've noticed that a directory of mine that lies under /Library/Application Support/myCompany/myProj/myFolder has been mysteriously deleted.

Is there a way to check in retrospect which process deleted my directory ?

I know of fs_usage, but it's used to record ongoing file activities... the question is how to get file auditing event from the past.

Thanks

Boost

Answer 1

DTS Engineer OP

Apple

Dec ’22

Is there a way to check in retrospect which process deleted my directory?

No. macOS does support this sort of thing — using Endpoint Security or the legacy BSM audit subsystem — but you have to enable it beforehand.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0