To determine the applications that create disk space files in the user’s home catalog, a background process known as Whomade has been developed. Whomade monitors the appearance of new files using the fanotify mechanism. This project, written in C++, is distributed under the GPL v3 license.
The data collected by Whomade is stored in a SQLite3 database, which is periodically cleaned to remove irrelevant information, such as details about remote files. Whomade currently uses Fanotify to track file openings and filter out unnecessary events, rather than directly monitoring file creation operations. It requires ROOT rights to run due to its dependency on fanotify.
For users of the Mate desktop environment, a Caja file manager extension has been provided. This extension displays information about the process that created a selected file, offering a convenient way to track file origins.
