How can I track the file level changes done by an application during execution on an Android device. Specifically I am interested in file level changes done by a malware - create, delete, save a file on the device.

While searching this forum I found one way is - /proc//fd. Is there any other way ? using logcat,Frida or any other way ?


Other than the options you mentioned, There's a seriously long way to do this, the best way in my opinion.

It's very basic and effective, I used this method to find the files or folders that KingRoot modified, created or deleted.

It's one of the oldest methods around,
Compare a base image & after install image.

  • Backup the device ( in stock condition is better )

    • system

    • data
      ( call it Base Image )

  • Install and run the application

  • Backup the device again
    ( call it Test Image )

  • Transfer the backups to a PC

  • Extract the backup's into two separate folders

  • Use a comparison tool to test for differences between the folders

  • Identify any Deleted, Modified & Created data

I used WinMerge or something like that, it is designed to help merge folders, however it is enough to do the comparison.

You can also compare the compressed images without extraction by using a Hex editor that has file comparison tools.

I use HxD Hex Editor to compare files on PC.

  • 1
    An even simpler approach could be something like find /path -mmin -10 instead of creating backup. In order to reverse changes, an initial backup would suffice. – Irfan Latif Feb 25 '19 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.