fseventer is a tool that visualizes file system access.
You can determine what files are changed on a software installation, deinstallation or what a suspicious piece of software is actually doing.
The usage is quite simple, start and press the "Record" button, and the application will record any filesystem access.
You can search the log for process or filenames, and choose between 2 views: a events based and a tree based view.
A file inspector gives you details about the operations.
Requires admin access & will only work on Mac OS X 10.4+ i.e. “Tiger”, “Leopard”, “Snow Leopard” or "Lion".