Fseventer tracks changes on your hard drive

[Editor’s note: The following review is part of Macworld’s GemFest 2009 series. Every day until the end of June 2009, the Macworld staff will use the Mac Gems blog to briefly cover a favorite free or low-cost program. Visit the Mac Gems homepage for a list of past Mac Gems.]

Have you ever wondered what a non-Apple software installer actually installs? Or what files a particular program is actually creating or modifying when it’s churning away? Fseventer is a clever tool that can help you solve these mysteries.

Fseventer uses a tool called fslogger –which itself accesses the same mechanism Spotlight uses to track changes on your drives–to monitor changes to your file system (thus the name fseventer—file system eventer). It then displays a graphical version of those changes, in real time.

To use Fseventer, you launch the program, click on the Start (play) button, and start doing whatever it is you want Fseventer to track. (The first time you start monitoring, you’ll need to provide the username and password of an admin-level account, as the program requires administrative access to be able to monitor your entire drive.) Then just sit back and watch as the program displays a graphical representation of files created, deleted, or modified while Fseventer is monitoring. Files represented by black text are files accessible by you that have been changed; those in red text are files that either have been deleted or are inaccessible to you (it would be useful if the program could differentiate between the two). You can zoom in and out on the display to get a better look at, say, changes made within the /Library directory.

If you hold the mouse cursor over a file, you’ll see some brief info about the most recent change to that file: the type of change, when it was made, and by what program. To get more details about changes, click on the Info button in the toolbar and then click on a file; the info window displays a change history for that file, beginning when Fseventer started monitoring.

If Fseventer’s window is getting too crowded, you can click on a file or folder and press the delete key to hide the display of that file or folder. For example, if I’m using Fseventer to see what files a software installer modifies or installs, and I don’t care about changes inside my home folder, I can hide /Users/frakes; I also find it useful to hide my Time Machine volume if a backup starts while I’m monitoring. (Unfortunately, there’s no way to undo this action; you need to stop monitoring and then start monitoring again to reset hidden items.) Alternatively, the program’s Filter feature lets you filter the display based on process name, file path, or a number of other attributes. The “process: frontmost” filter is especially useful as a way to track a particular program’s activity.

Fseventer also offers a list view that shows a chronological list of file system activity. You can insert flags in the list to mark specific points in time; for example, you can mark the point when you performed a particular action in another program.

One limitation of Fseventer is that there are a few types of modifications and actions the program doesn’t recognize–applications being launched or volumes being mounted, for example. Still, I’ve found it to be invaluable for monitoring installers and apps to see what they’re doing.

Want to stay up-to-date with the latest Gems? Sign up for the Mac Gems newsletter for a weekly e-mail summary of Gems reviews sent directly to your inbox.

Our 186-page Mac Gems Superguide is a veritable greatest hits of Mac Gems. It’s available as a PDF download, PDF on CD-ROM, or as a printed book. Learn more about the Mac Gems Superguide.

[Dan Frakes is a Macworld senior editor.]