How to create a copy of a file immediately when it's created?

Question

I have an Android app that will create a file and immediately delete it. I want to know how can I catch this file or create a copy or even disable user permissions to delete a file. I have root access to the device.

Answer 1

You can achieve this using inotifywait from inotify-tools. Your kernel must be built with CONFIG_INOTIFY_USER=y for this to work. You can confirm with:

~# zcat /proc/config.gz | grep INOTIFY

Or the existence of /proc/sys/fs/inotify directory. /proc/config.gz may not exist on all devices depending on kernel build configuration.

Let's say /data/data/com.xyz/files/ is the directory you want to watch.

~$ mkdir -p /sdcard/backup/
~# inotifywait -rm --format '%w%f' -e create /data/data/com.xyz/files/ |
while read file
do
    [ -f "$file" ] && cp -av "$file" /sdcard/backup/
done

-e create is the event that reports that a file/directory is created in watched directory, --format is to get filename with complete path, -m is to watch continuously and -r establishes watches recursively. -d can daemonize the process i.e. run in background.

All newly created files in watched directory or in any sub-directory will be copied to /sdcard/backup.

You can also use busybox inotifyd for simple use case as explained here. For more options see inotifywait(1).

RELATED: How to identify the app/process which re-mounts partitions R/W, creates files and changes file permissions?