I have an Android app that will create a file and immediately delete it. I want to know how can I catch this file or create a copy or even disable user permissions to delete a file. I have root access to the device.

  • I'm pretty sure there's a way to monitor a directory for changes, at least sometimes... I'd start by searching for that
    – Xen2050
    Commented Mar 26, 2019 at 1:20
  • @Xen2050 i find the answer i can do it with inotify but because the linux is on android i can't install it easily im trying to install it
    – Amin
    Commented Mar 26, 2019 at 1:21
  • I think inotify's right, no idea how to get it working with android either. Possibly a program/script that just reads a directory every second & immediately copies new files might work too, but might be resource intensive & slow things down
    – Xen2050
    Commented Mar 26, 2019 at 1:24
  • @Xen2050 its on an emulator so i don't care about performance
    – Amin
    Commented Mar 26, 2019 at 1:25
  • Could just loop some find/ls & sleep 0.25 commands then, maybe with an array of found files, then when it changes do something?
    – Xen2050
    Commented Mar 26, 2019 at 1:27

1 Answer 1


You can achieve this using inotifywait from inotify-tools. Your kernel must be built with CONFIG_INOTIFY_USER=y for this to work. You can confirm with:

~# zcat /proc/config.gz | grep INOTIFY

Or the existence of /proc/sys/fs/inotify directory. /proc/config.gz may not exist on all devices depending on kernel build configuration.

Let's say /data/data/com.xyz/files/ is the directory you want to watch.

~$ mkdir -p /sdcard/backup/
~# inotifywait -rm --format '%w%f' -e create /data/data/com.xyz/files/ |
while read file
    [ -f "$file" ] && cp -av "$file" /sdcard/backup/

-e create is the event that reports that a file/directory is created in watched directory, --format is to get filename with complete path, -m is to watch continuously and -r establishes watches recursively. -d can daemonize the process i.e. run in background.

All newly created files in watched directory or in any sub-directory will be copied to /sdcard/backup.

You can also use busybox inotifyd for simple use case as explained here. For more options see inotifywait(1).

RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?

  • hi link the easiest way is to work with this c library
    – Amin
    Commented Mar 26, 2019 at 13:35
  • I could not make this way to work but the c script is worked just fine and a lot easier but maybe the problem was with my execution.
    – Amin
    Commented Mar 26, 2019 at 13:47
  • hi im steel stuck can you please help me a little bit? im really confused i can't execute this c script either
    – Amin
    Commented Mar 26, 2019 at 23:25
  • 1
    @Amin Looks like you only got the library (libinotify), not the command-line tools (inotify-tools). Anyway you never get dex file, dex is Java code, and is not executed on command-line level. Command-line tools are native executables.
    – Robert
    Commented Mar 28, 2019 at 14:47
  • 1
    All Android kernels should support inotify tools because Android API contains FileObserver which bases on inotify. Hence any official kernel have to support it otherwise it could not pass the Google compatibility test.
    – Robert
    Commented May 7, 2020 at 10:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .