Mac OS X: Finding Where Settings Are Stored

Mac OS X stores some configuration information in fairly obvious places, like the various user and local library Preferences directories. But some settings (e.g. printers, network, directory services, etc.) are stored in more obscure locations, including directories that aren't even visible in the Finder.

Fortunately, it's not too hard to ferret out where these settings are, once you know the trick of using the find command to track recently modified files. While you can't tell find to find everything modified in, say, the last five minutes, you can have it search for everything modified more recently than a certain file (which it treats as what amounts to a timestamp). So the basic approach is to create/modify a timestamp file, change the setting we're looking for, then search the filesystem for what files got modified since the timestamp.

Here's an example of the procedure (I'll use the example of finding where the default printer is kept, but you can use basically the same basic process for lots of things):

Get ready to change the setting of interest. In this case, that means opening the Print Center utility, so I can use it to switch default printers.
Open a Terminal window, and use the command "sudo -s" to get a root shell. We'll need root access in order to search the entire boot partition, since some areas are protected against general access. Note that you must be an administrator to use this command, and it'll ask for your admin password to verify your identity.
Use the command "touch ~/timestamp" to create and/or modify a timestamp file.
Change the setting. In this case, select a new printer in the Print Center window, then select "Make Default" from the Printers menu. Just to make sure the change got saved to disk, I'd quit Print Center at this point.
Go back to the terminal, and use the command "find -x / -newer ~/timestamp >~/changedfiles.txt" to generate a list of changed files, and store it in your home directory under the name "changedfiles.txt".
Open changedfiles.txt in your favorite text editor, and look through it for likely suspects. In this example, I got the following list:
/automount /Network/Servers /private/var/spool/printing/com.apple.printing.plist /private/var/vm /private/var/vm/swapfile1 /Users/gordon /Users/gordon/Library/Preferences /Users/gordon/Library/Preferences/com.apple.print.PrintCenter.plist /Users/gordon/Library/Preferences/com.apple.recentitems.plist /Users/gordon/changedfiles.txt
Some of these files are things that get constantly changed as the system runs (e.g. swapfile1); some are results of things I did besides changing the default printer (e.g. com.apple.recentitems.plist, and of course changedfiles.txt itself). Looking at the list, there's one obvious candidate for where the default printer is recorded: /private/var/spool/printing/com.apple.printing.plist.

The answer may not always be as obvious as in this case, but this approach should at least give you some idea what take a closer look at.

By the way, if the list of changed files includes anything in /private/var/db/netinfo, that means something in your NetInfo database got changed. The precise files that got modified don't tell you much, you need to use NetInfo Manager or something silimar to look at the contents of the database in coherent form and scan for changes.