3

I have an Android app that will create a file and immediately delete it. I want to know how can I catch this file or create a copy or even disable user permissions to delete a file. I have root access to the device.

  • I'm pretty sure there's a way to monitor a directory for changes, at least sometimes... I'd start by searching for that – Xen2050 Mar 26 '19 at 1:20
  • @Xen2050 i find the answer i can do it with inotify but because the linux is on android i can't install it easily im trying to install it – Amin Mar 26 '19 at 1:21
  • I think inotify's right, no idea how to get it working with android either. Possibly a program/script that just reads a directory every second & immediately copies new files might work too, but might be resource intensive & slow things down – Xen2050 Mar 26 '19 at 1:24
  • @Xen2050 its on an emulator so i don't care about performance – Amin Mar 26 '19 at 1:25
  • Could just loop some find/ls & sleep 0.25 commands then, maybe with an array of found files, then when it changes do something? – Xen2050 Mar 26 '19 at 1:27
3

You can achieve this using inotifywait from inotify-tools. Your kernel must be built with CONFIG_INOTIFY_USER=y for this to work. You can confirm with:

~# zcat /proc/config.gz | grep INOTIFY

Or the existence of /proc/sys/fs/inotify directory. /proc/config.gz may not exist on all devices depending on kernel build configuration.

Let's say /data/data/com.xyz/files/ is the directory you want to watch.

~$ mkdir -p /sdcard/backup/
~# inotifywait -rm --format '%w%f' -e create /data/data/com.xyz/files/ |
while read file
do
    [ -f "$file" ] && cp -av "$file" /sdcard/backup/
done

-e create is the event that reports that a file/directory is created in watched directory, --format is to get filename with complete path, -m is to watch continuously and -r establishes watches recursively. -d can daemonize the process i.e. run in background.

All newly created files in watched directory or in any sub-directory will be copied to /sdcard/backup.

You can also use busybox inotifyd for simple use case as explained here. For more options see inotifywait(1).

RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?

| improve this answer | |
  • hi link the easiest way is to work with this c library – Amin Mar 26 '19 at 13:35
  • I could not make this way to work but the c script is worked just fine and a lot easier but maybe the problem was with my execution. – Amin Mar 26 '19 at 13:47
  • hi im steel stuck can you please help me a little bit? im really confused i can't execute this c script either – Amin Mar 26 '19 at 23:25
  • 1
    @Amin Looks like you only got the library (libinotify), not the command-line tools (inotify-tools). Anyway you never get dex file, dex is Java code, and is not executed on command-line level. Command-line tools are native executables. – Robert Mar 28 '19 at 14:47
  • 1
    All Android kernels should support inotify tools because Android API contains FileObserver which bases on inotify. Hence any official kernel have to support it otherwise it could not pass the Google compatibility test. – Robert May 7 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.