[Captain Code]

Check out FSEvents. From what I remember you can get changes to the file system between two points from it so that might work. I also wrote some code to process a large number of files looking for only executable binary files and wound up finding some code that reads the first 4 bytes of the file and I can check that value against what it should be for executable code. It worked so much faster doing it that way then launching thousands of NSTasks.

I'm not sure how far back FSEvents would go so that might not work but I remember from WWDC you could query it for changes since your last query & other things like that. It might only work since your last query if the process hasn't been quit and relaunched but I don't really know just guessing.