I have an Android app that will create a file in
/data/ and immediately delete it. I want to know how can I catch this file or create a copy or even disable user permissions to delete a file? I have root access to the device.
You can achieve this using
busybox inotifyd. Your kernel must be built with
CONFIG_INOTIFY_USER=y for this to work. You can confirm with:
~# zcat /proc/config.gz | grep INOTIFY
Or the existence of
/proc/config.gz may not exist on all devices depending on kernel build configuration.
/data/data/com.xyz/files/ is the directory you want to watch. Write a script to execute when a file or directory is created in the given directory:
# remove first argument: EVENT
# create directiry to backup files
mkdir -p /sdcard/backup/
# copy newly created file/directory
[ -e "$1/$2" ] || exit
cp -av "$1/$2" /sdcard/backup/
Place the script at
chmod a+x. Now execute:
~# inotifyd /data/local/tmp/copy_it.sh /data/data/com.xyz/files:n
:n at the end of line, which is the event that reports that a file/directory is created in watched directory. However watches are not established recursively.