File metadata.json appears on desktop I apologize if this is impossible to debug, but this has been happening on my Mac with macOS Sierra 10.12.2 installed since a few weeks and I thought I'd give it a shot. 

Basically, a metadata.json file gets automagically created on my desktop. I delete it. It appears again after a while. GOTO 1.

Google gets a bit mixed up when I search for answers.

So, how would I begin to find out which app is the culprit?

Edit: this is the file contents (duh!):

{"name":"Desktop","modificationTime":1484074718317,"categories":[]}




I run the suggested command and I got this:

501    788 Sketch        -1 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    356 bird          25 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    788 Sketch        29 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    22 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    22 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    720 mdworker      10 /Users/ignacio/Desktop/metadata.json
dtrace: 2154 dynamic variable drops with non-empty dirty list
  501    908 Sketch        -1 /Users/ignacio/Desktop/metadata.json
  501    356 bird          25 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    908 Sketch        18 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
    0     76 mds           16 /Users/ignacio/Desktop/metadata.json
  501    718 mdworker      10 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    347 Finder        13 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
  501    893 quicklookd    21 /Users/ignacio/Desktop/metadata.json
You can use opensnoop to see what app writes to that location.

sudo opensnoop | grep metadata.json



  To disable System Integrity Protection, you can do the following:
  
  
  Boot into the Recovery HD by restarting whilst holding ⌘R.
  Open Terminal (from the Utilities menu).
  Run the following command in Terminal:

csrutil disable

  Restart.
  


Source: Disable OS X El Capitan Rootless and permit write actions to System Integrity Protection locations