Mac OS X: Finding Where Settings Are Stored
Mac OS X stores some configuration information in fairly obvious places, like
the various user and local library Preferences directories. But some settings
(e.g. printers, network, directory services, etc.) are stored in more obscure
locations, including directories that aren't even visible
in the Finder.
Fortunately, it's not too hard to ferret out where these settings are, once you
know the trick of using the find
command to track recently modified files. While you can't tell
find to find everything modified
in, say, the last five minutes, you can have it search for everything modified more
recently than a certain file (which it treats as what amounts to a timestamp). So
the basic approach is to create/modify a timestamp file, change the setting we're
looking for, then search the filesystem for what files got modified since the
Here's an example of the procedure (I'll use the example of finding where the
default printer is kept, but you can use basically the same basic process for lots
- Get ready to change the setting of interest. In this case, that means opening
the Print Center utility, so I can use it to switch default printers.
- Open a Terminal window, and use the command
"sudo -s" to get a root
shell. We'll need root access in order to search the entire boot partition,
since some areas are protected against general access. Note that you must be
an administrator to use this command, and it'll ask for your admin password to
verify your identity.
- Use the command "touch ~/timestamp" to create and/or modify a
- Change the setting. In this case, select a new printer in the Print Center
window, then select "Make Default" from the Printers menu. Just to make sure the
change got saved to disk, I'd quit Print Center at this point.
- Go back to the terminal, and use the command "find
-x / -newer ~/timestamp >~/changedfiles.txt" to generate a list of changed
files, and store it in your home directory under the name "changedfiles.txt".
- Open changedfiles.txt in your favorite text editor, and look through it for likely
suspects. In this example, I got the following list:
Some of these files are things that get constantly changed as the system runs
(e.g. swapfile1); some are results of things I did besides changing the
default printer (e.g. com.apple.recentitems.plist, and of course changedfiles.txt
itself). Looking at the list, there's one obvious candidate for where the default
printer is recorded: /private/var/spool/printing/com.apple.printing.plist.
The answer may not always be as obvious as in this case, but this approach should
at least give you some idea what take a closer look at.
By the way, if the list of changed files includes anything in /private/var/db/netinfo,
that means something in your NetInfo database got changed. The precise files that got
modified don't tell you much, you need to use NetInfo Manager or something silimar to
look at the contents of the database in coherent form and scan for changes.