Ask HN: Tool that lets you identify changes an app makes to the disk?

Here are some suggestions:

If you are on *nix you can list all the files that a process is using: $ lsof -p <PID>,<PID>,<PID>

Then do a diff of the listed files against older versions of the files (e.g from a backup).

On Windows you can use procmon.exe (its a free tool from Microsoft that lists all network, registry and files) and see the updates in realtime.

Hope those work.

Thanks guys this is a great starting point. I'll try each out and see how what works best. If I discover anything interesting I'll put a blog post up outlining in case others run into the same.

strace can do it (Linux). Watch out for "open", "read","write","unlink" in the output - these are some of the filesystem operations.

inotifywatch (from inotify-tools) can show you changes made to files in a particular directory.

DTrace?