SlackBuildsOrg/system/trackfs

trackfs (tracks filesystem changes)

Trackfs is a small program that tracks file system changes --
creation, update and removal of fs objects -- of another program (or
group of programs).  It is similar to `installwatch', but works quite
differently: While installwatch uses LD_PRELOAD to intercept library
functions like open() and unlink(), trackfs runs the child program(s)
with tracing enabled and tracks the system calls they make.

trackfs also includes "playback", which runs a program via trackfs
and creates a shell script which, when run, will reverse all filesystem
changes made by the program.