
Now, while leaving this window open, open a Terminal window and run the following: sudo opensnoop | grep -v '/.vol' | grep "System Pref"Įnter your password, and wait. Open System Preferences » Desktop & Screen Saver » Screen Saver and select the folder you want to locate to see a preview. The path, of course, is /Users/danielbeck/Pictures. On my system, it looks like this: file:///Users/danielbeck/Pictures/

Now the return value (much binary data) is filtered for a file URL. This will first get the most recent .*.plist file that does not contain slideshow in its name and read its contents: the relevant entry of the property list file is moduleDict:fileRef. Now run the following command in Terminal: /usr/libexec/PlistBuddy -c 'Print moduleDict:fileRef' $( ls -t ~/Library/Preferences/ByHost/.*.plist | grep -v slideshow | head -n1 ) | grep -oaE 'file://]+/' The location is stored in ~/Library/Preferences/ByHost/.*.plist, * being a UUID.

Monitor file system accesses while images from that folder are displayed.

