Inspecting modifications on the COW root filesystem

[lik...@gmx.de]

Hi!

According to the architecture spec, the root filesystem is backed up by a COW device to "allow" write-access to the read-only root filesystem:
https://www.qubes-os.org/attachment/wiki/QubesArchitecture/arch-spec-0.3.pdf (4.1)

Is there a possibility to investigate which files were modified or added (maybe also deleted?) und this writable root filesystem overlay? I'd like to look only at the write-only overlay without seeing the read-only files.

It can be usefull to
- investigate changes of programs which modify the system to work properly
- find misbehaving programs

Thanks, Pete.