KNIGHTSBRIDGE (Rixstep) — Tracker is the ACP's tool for detecting changes to a filesystem. Tracker tracks everything. Tracker can be helpful when attempting to uninstall unwanted software. Nothing escapes Tracker, because nothing escapes your filesystem.
You typically start a tracking session by setting a timestamp. This tells Tracker to look for files that have been accessed, created, or modified after that time.
Your second time stamp, the upper limit to what Tracker is supposed to look for, is implicitly set when you begin tracking filesystem changes.
This may sound more difficult than it actually is, therefore a video tutorial. Put the video in a separate window and enlarge it so you can see what's going on.
Tracker will do the following:
Fetch a timestamp. All timestamps are archived until you decide to remove them.
Set your 'scan paths'. You can limit your tracking to specific folders. If the software you're tracking does not, even indirectly, use privilege escalation - if you've not submitted your password on behalf of the software you're tracking - then you can pretty much hold to your own home user area. (There are a few exceptions - see below.)
Additional folders. The additional folders you should always scan are /Library and /private. Ordinary software, running on an ordinary account, can still get into those two locations.
Scan your own home area. This will turn up as '~' (tilde) in Tracker. If you've installed software in /Applications, then you should scan /Applications as well.
Set your 'skip paths'. This is the list of folders you absolutely don't think Tracker needs to scan. Default (recommended) skip paths are /private/var/db/diagnostics, /private/var/db/systemstats, /private/var/db/uuidtext, and ~/Library/Developer. The first three contain bits and pieces of the new logging system, and the fourth and final folder belongs to Xcode. Nothing's going to happen there, but skipping it saves a lot of time.
Click the 'Track' button. Then just wait. If you need to stop things, just click the 'Stop' button.
Inspect the results. These results can be saved as a 'Playback' file, so you can return to this session at any time. You can also create a text 'export' of a 'Playback' at any time. Note that files that have been modified are listed in bold, and files that are merely accessed are not included in the default list. (Toggle 'List Accessed' on the 'File' menu to change this.
Tracker is otherwise much like a standard file manager. You can drag and copy and move files, as well as delete them. Standard functions found in other ACP utilities are also available.
OK, so here we go. Enjoy the tutorial, and good luck with Tracker!
Tracker for Mojave (macOS 10.14)
Tracker for Mojave (macOS 10.14) uses a new internal logic. Running on modern solid-state drives (SSDs) Tracker is amazingly fast, as can be seen in the clip above. Use Tracker to monitor new software, to see where it goes and what it does.
Note: Tracker is not 'heuristic' as the myriad 'app uninstallers' out there. Tracker does not guess. Tracker knows.
Stockholm/London-based Rixstep are a constellation of programmers and support staff from Radsoft Laboratories who tired of Windows vulnerabilities, Linux driver issues, and cursing x86 hardware all day long. Rixstep have many years of experience behind their efforts, with teaching and consulting credentials from the likes of British Aerospace, General Electric, Lockheed Martin, Lloyds TSB, SAAB Defence Systems, British Broadcasting Corporation, Barclays Bank, IBM, Microsoft, and Sony/Ericsson.
Rixstep and Radsoft products are or have been in use by Sweden's Royal Mail, Sony/Ericsson, the US Department of Defense, the offices of the US Supreme Court, the Government of Western Australia, the German Federal Police, Verizon Wireless, Los Alamos National Laboratory, Microsoft Corporation, the New York Times, Apple Inc, Oxford University, and hundreds of research institutes around the globe. See here.