site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Nov 19, 2007, at 11:30 PM, Kynan Shook wrote: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... For a small research project, I'm interested in all the data written to (and possibly read from) a couple files. From lots of googling and a little playing around, the SampleFilterScheme example can do what I need; I was able to modify it slightly and see the data going through it in system.log. Are you interested in "all the data written to/read from", or "all the data moved to/from the disk"? The two are *very* different things. If the latter, then fine, but if the former then a filter scheme is totally the wrong thing to be using. You want to use dyld interposing and catch the system calls as they are made by the application(s) actually operating on the file(s) in question. This email sent to site_archiver@lists.apple.com