How to make/compare filesystem/registry snapshots in Windows?

Question

What's a simple way to get a list of all files installed/modified and keys added/removed by a Windows (XP, Vista or 7) program installer?

I'd like to take a before and after snapshot, and see what has changed. Leaving a program running while I perform the install would be okay too.

This is very similar to Clinton Blackmore's question (eg: taking and diff'ing two file systems), but specifically for Windows, and taking into account both files and registry keys.

Answer 1

There are lots of tools capable of this, Windows 2000 was even shipped with a version of wininstall if I'm not mistaken - anyway, it's available for free these days.

The trouble is avoiding false positives - ie changes made by the operating system that was not related to the installer - so some care and manual editing is always needed.

Answer 2

Some free tools you could use:

What Changed 1.06

What Changed is a simple utility that searches for modified files and registry entries. It is useful for checking program installations.

There are two steps for using What Changed:

1. First, take a snapshot of the state of the system
2. Second, run What Changed again to see the differences from the previous snapshot.

TrackWinstall

A free tool by Matthias Withopf which tracks system changes (file system, registry). The site and the program is in German, but there is a link to translate the page into English.

RegShot

Regshot is an open-source(GPL) registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product.