You can achieve this using
busybox inotifyd. Your kernel must be built with
CONFIG_INOTIFY_USER=y for this to work. You can confirm with:
~# zcat /proc/config.gz | grep INOTIFY
Or the existence of
/proc/config.gz may not exist on all devices depending on kernel build configuration.
/data/data/com.xyz/files/ is the directory you want to watch. Write a script to execute when a file or directory is created in the given directory:
# remove first argument: EVENT
# create directiry to backup files
mkdir -p /sdcard/backup/
# copy newly created file/directory
[ -e "$1/$2" ] || exit
cp -av "$1/$2" /sdcard/backup/
Place the script at
chmod a+x. Now execute:
~# inotifyd /data/local/tmp/copy_it.sh /data/data/com.xyz/files:n
:n at the end of line, which is the event that reports that a file/directory is created in watched directory. However watches are not established recursively.
For more complex operations, use
inotifywait from inotify-tools as explained here.
RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?