SlackBuildsOrg/system/trackfs

Trackfs is a small program that tracks file system changes -- creation,
update and removal of fs objects -- of another program (or group of
programs).  It is similar to `installwatch', but works quite differently:
While installwatch uses LD_PRELOAD to intercept library functions like
open() and unlink(), trackfs runs the child program(s) with tracing
enabled and tracks the system calls they make.

trackfs also includes "playback", which runs a program via trackfs
and creates a shell script which, when run, will reverse all filesystem
changes made by the program.