I am currently doing a project which requires me to compare a "before" and an "after" of an Android phone file system. It is mainly for me to identify the modifications that were made to the file system.

I do not wish to take multiple screenshots of the "before" and "after" directories as there will be a lot of screenshots. So, I was wondering is there any software in the market that takes a "before" and "after" snapshot of the file system? (So that it will be better for comparison).

I would love software recommendations that are executable on Ubuntu (I am connecting my Android phone through ADB)

  • Speaking of file system snapshots: Is the device-in-question rooted? Else you won't get such low-level access as is needed for a file-system snapshot. If it is: Would partition images be acceptable? My tool Adebar a.o. creates a script for that.
    – Izzy
    May 9 '19 at 18:11
  • 1
    @Izzy I intend to root my device, but havent done so. Partition images are acceptable! I will take a look at your suggestion! Thank you! May 10 '19 at 1:28
  • Let me know then if it fits and I should make that an answer. Good luck for now!
    – Izzy
    May 10 '19 at 6:06

I hope that you do not really mean that you want to take “screenshots”? Maybe “snaphot”, which just implies recording the status of something at a point in time,. It would be much easier to programmatically compare two snapshots than two screenshots.

You almost certainly want a “file system monitor”, so search for android file system monitor. That way, you don’t need to take snapshots (or screenshots). You tell the operating system that you are interested in changes to a given file, directory or directory tree, and your software will be notified of any changes.

Some encouraging search results include:

  • 2
    Hi! I think i was referring to snapshots, but in the event that there wasn't any file system monitoring tool, I really thought of taking a screen capture of the various directories and do a manual comparison. I will take a look at your suggestions! Thank you so much! May 10 '19 at 1:25
  • 1
    Please let us know if you get a solution, as that will help others who read this in future. It is ok to post your own answer, if you find something on your own May 10 '19 at 10:45
  • 1
    Hi @Mawg, may i ask have you tried installing fsmon onto Android? I have been trying to do so for the past few days and I'm not sure whether I'm doing it correctly May 24 '19 at 0:40
  • I don't see it in the app store. If you tell me where to find it, I will try. Are you saying that can't install, or that you are not sure if it is running correctly? For the latter, monitor downloads & d/l something, or monitor the images directory & take a photo; that should tell you if it working correctly. May 24 '19 at 6:44
  • I downloaded the zip file from here, but while following the installation instruction in the README file, i encountered this error. Initially, I thought you have used the utility before, but if it's a hassle, you don't need to help me install it! I wouldn't want to waste your precious time :) May 24 '19 at 7:04

Note: All the tools referred in this answer are already/easily available on Android.

You didn't mention which filesystem you want to monitor and whether you have access to that filesystem without root or not.
It's really hard to monitor an active filesystem like /data which has hundreds of files being accessed and modified every moment. On the other hand a read-only filesystem like /system never gets changed and you can easily identify any modifications.


A simple approach would be to take last modification date/time of all files on the filesystem and save the result as a text file. I assume you are interested in tracking changes made to a subdirectory of /data partition:

~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >before.txt

After making changes to filesystem:

~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >after.txt

Now take a comparison of both:

~$ diff before.txt after.txt

You will identify all modified, removed and added files / directories / symlinks.


If the target is to identify more aggressively the possible hidden changes to a file e.g. made by some malware which retained modification time, create a MD5 checksum (works only for files):

~# find /data/xyz -type f -print0 | xargs -0 -I {} md5sum '{}' >checksums

After making changes:

~# md5sum -c --quiet checksums

It will identify any file changed even if the metadata of file is intact.


If you want to see the files being changed in realtime when you make changes, you can make use of Linux kernel's inotify subsystem. A simple way is to use busybox inotifyd:

~# inotifyd - /data/xyz

It will print out any kind of events happening to the watched file/directory.

Or use inotifywait for more options. See this answer for details.

In order to find out what changes have been made to a file such as some configuration file, take a backup of that file/directory (or whole filesystem) prior to making changes.

RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.