Software recommendations to monitor Android File System

Question

I am currently doing a project which requires me to compare a "before" and an "after" of an Android phone file system. It is mainly for me to identify the modifications that were made to the file system.

I do not wish to take multiple screenshots of the "before" and "after" directories as there will be a lot of screenshots. So, I was wondering is there any software in the market that takes a "before" and "after" snapshot of the file system? (So that it will be better for comparison).

I would love software recommendations that are executable on Ubuntu (I am connecting my Android phone through ADB)

Answer 1

I hope that you do not really mean that you want to take “screenshots”? Maybe “snaphot”, which just implies recording the status of something at a point in time,. It would be much easier to programmatically compare two snapshots than two screenshots.

You almost certainly want a “file system monitor”, so search for android file system monitor. That way, you don’t need to take snapshots (or screenshots). You tell the operating system that you are interested in changes to a given file, directory or directory tree, and your software will be notified of any changes.

Some encouraging search results include:

• Fsmon – with source code on GitHub. There is an atrcile on it here. Note that it is a complete tool, but you probably only need part of it.
• The Android docs say that you can use FileObserver which can monitor a file or directory (tree). This S.O question gives sample code
• As does this s.o question

Answer 2

Note: All the tools referred in this answer are already/easily available on Android.

You didn't mention which filesystem you want to monitor and whether you have access to that filesystem without root or not.
It's really hard to monitor an active filesystem like /data which has hundreds of files being accessed and modified every moment. On the other hand a read-only filesystem like /system never gets changed and you can easily identify any modifications.

OPTION 1:

A simple approach would be to take last modification date/time of all files on the filesystem and save the result as a text file. I assume you are interested in tracking changes made to a subdirectory of /data partition:

~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >before.txt

After making changes to filesystem:

~# find /data/xyz -print0 | xargs -0 -I {} stat -c '%Y %n' '{}' | sort -k2 >after.txt

Now take a comparison of both:

~$ diff before.txt after.txt

You will identify all modified, removed and added files / directories / symlinks.

OPTION 2:

If the target is to identify more aggressively the possible hidden changes to a file e.g. made by some malware which retained modification time, create a MD5 checksum (works only for files):

~# find /data/xyz -type f -print0 | xargs -0 -I {} md5sum '{}' >checksums

After making changes:

~# md5sum -c --quiet checksums

It will identify any file changed even if the metadata of file is intact.

OPTION 3:

If you want to see the files being changed in realtime when you make changes, you can make use of Linux kernel's inotify subsystem. A simple way is to use busybox inotifyd:

~# inotifyd - /data/xyz

It will print out any kind of events happening to the watched file/directory.

Or use inotifywait for more options. See this answer for details.

---

In order to find out what changes have been made to a file such as some configuration file, take a backup of that file/directory (or whole filesystem) prior to making changes.

RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?