Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Question

Is there a decently-priced (free preferred) tool that will allow me to see all changes made to a system (disk, registry, etc.) during the process of an install?

Background

I would like to capture changes made by a software installation so that I can forward them to a security team who will be able to white-list and authorize those actions.

At the current time, if an install makes changes to the user's documents folder or adds a registry key, we don't have a good way of picking that up. And I know there must be a better way.

Thanks in advance for any help you can give!

share|improve this question
add comment

3 Answers

There are several ways of accomplishing this. One of my favorites is using WinInstall LE to capture the installation package. The same pre / post snapshot method is available in many products. It'll detail exactly what changes are being made.

You can also use a couple of the sysinternals tools to do the same thing but it tends to have more background noise.

share|improve this answer
add comment

I've been using What Changed.

Its small, portable, fast, and free. It does an 'actual' before and after scan. This should produce a report suitable for your auditors.

share|improve this answer
1  
How is WhatChanged "fast"? It took it more than FIVE HOURS (I'm not sure how many, because after five hours I left it running and went to sleep) to snapshot and compare a 120GB SSD system, with a 2.67GHz CPU. What took longest was actually comparing the registry snapshot after installing the target software. That took at least FOUR HOURS. This is ridiculous, as dumping the registry before and after and doing a diff should take less than a minute. –  Dan Dascalescu Dec 3 '12 at 3:34
2  
Update: I looked at the logs. It took WhatChanged EIGHT HOURS to finish comparing the "after" state with the "before" snapshot. The bulk (SIX HOURS) was the comparison of registry keys. Maybe this is because WhatChanged stores the entries in line-based files instead of, say, SQLite. As far as files are concerned, WhatChanged stores the snapshot, again, as comma-separate <filename>,<size> (not a checksum!) entires. By far, the worst Windows system snapshot comparison tool I've ever seen, despite its portability and small footprint. –  Dan Dascalescu Dec 3 '12 at 6:14
    
Also, no Windows-specific intelligence to exclude irrelevant changes, like HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs‌​. @RobW, can you please amend this answer? I'd vote it down, but don't have the reputation yet. –  Dan Dascalescu Dec 3 '12 at 6:16
2  
Baseline collection was okay; what took inexplicably longer was the second registry snapshot and comparison. While in the vast majority of cases I do notify the developers, due to the systemic flaws that I mentioned in my comments #2 and #3, I didn't bother in this case. BTW I noticed you haven't really said how fast WhatChanged was in your case. My mileage was one install that created 4 files and changed relatively few registry keys, compared to the size of the registry. –  Dan Dascalescu Dec 6 '12 at 14:34
1  
Dan's criticisms, while flamey, sound like they're totally justified if what he's saying is accurate. –  bwerks Dec 31 '12 at 19:43
show 2 more comments

I haven't used it personally, but I have a few developers who vouch for it. Here's a walk-through for it, too!

Also, here's a direct link to the software, called ZSoft Uninstaller (its free).

share|improve this answer
    
Maybe you would like to include the name of this mystery program. –  wfaulk May 10 '12 at 22:23
    
...Maybe........ –  JohnThePro May 10 '12 at 22:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.