[ILoveHorses]

I am curious how the author of the GitHub gist managed to figure all this out. Any ideas?

[halapro]

You can use fsevents to see which apps write where and firewalls will tell you which app is connecting to the internet.