I have an Android app that will create a file and immediately delete it. I want to know how can I catch this file or create a copy or even disable user permissions to delete a file. I have root access to the device.
You can achieve this using
inotifywait from inotify-tools. Your kernel must be built with
CONFIG_INOTIFY_USER=y for this to work. You can confirm with:
~# zcat /proc/config.gz | grep INOTIFY
Or the existence of
/proc/config.gz may not exist on all devices depending on kernel build configuration.
/data/data/com.xyz/files/ is the directory you want to watch.
~$ mkdir -p /sdcard/backup/ ~# inotifywait -rm --format '%w%f' -e create /data/data/com.xyz/files/ | while read file do [ -f "$file" ] && cp -av "$file" /sdcard/backup/ done
-e create is the event that reports that a file/directory is created in watched directory,
--format is to get filename with complete path,
-m is to watch continuously and
-r establishes watches recursively.
-d can daemonize the process i.e. run in background.
All newly created files in watched directory or in any sub-directory will be copied to