Is there a decently-priced (free preferred) tool that will allow me to see all changes made to a system (disk, registry, etc.) during the process of an install?


I would like to capture changes made by a software installation so that I can forward them to a security team who will be able to white-list and authorize those actions.

At the current time, if an install makes changes to the user's documents folder or adds a registry key, we don't have a good way of picking that up. And I know there must be a better way.

Thanks in advance for any help you can give!

3 Answers 3


There are several ways of accomplishing this. One of my favorites is using WinInstall LE (a free product which has changed hands many times over its lifetime) to capture the installation package. The same pre / post snapshot method is available in many products. It'll detail exactly what changes are being made.

You can also use a couple of the sysinternals tools to do the same thing but it tends to have more background noise.

  • Your link seems to be broken. Scalable apparently change its product name (and price ?), you can see it here
    – Trajan
    Sep 17, 2015 at 14:45

I haven't used it personally, but I have a few developers who vouch for it; ZSoft Uninstaller. It's free.

Here's a walk-through for it too!

  • 1
    Maybe you would like to include the name of this mystery program.
    – wfaulk
    May 10, 2012 at 22:23
  • ...Maybe........
    – JohnThePro
    May 10, 2012 at 22:27

I've been using What Changed.

Its small, portable, fast, and free. It does an 'actual' before and after scan. This should produce a report suitable for your auditors.

  • 1
    How is WhatChanged "fast"? It took it more than FIVE HOURS (I'm not sure how many, because after five hours I left it running and went to sleep) to snapshot and compare a 120GB SSD system, with a 2.67GHz CPU. What took longest was actually comparing the registry snapshot after installing the target software. That took at least FOUR HOURS. This is ridiculous, as dumping the registry before and after and doing a diff should take less than a minute. Dec 3, 2012 at 3:34
  • 2
    Update: I looked at the logs. It took WhatChanged EIGHT HOURS to finish comparing the "after" state with the "before" snapshot. The bulk (SIX HOURS) was the comparison of registry keys. Maybe this is because WhatChanged stores the entries in line-based files instead of, say, SQLite. As far as files are concerned, WhatChanged stores the snapshot, again, as comma-separate <filename>,<size> (not a checksum!) entires. By far, the worst Windows system snapshot comparison tool I've ever seen, despite its portability and small footprint. Dec 3, 2012 at 6:14
  • Also, no Windows-specific intelligence to exclude irrelevant changes, like HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs. @RobW, can you please amend this answer? I'd vote it down, but don't have the reputation yet. Dec 3, 2012 at 6:16
  • 2
    Baseline collection was okay; what took inexplicably longer was the second registry snapshot and comparison. While in the vast majority of cases I do notify the developers, due to the systemic flaws that I mentioned in my comments #2 and #3, I didn't bother in this case. BTW I noticed you haven't really said how fast WhatChanged was in your case. My mileage was one install that created 4 files and changed relatively few registry keys, compared to the size of the registry. Dec 6, 2012 at 14:34
  • 2
    Dan's criticisms, while flamey, sound like they're totally justified if what he's saying is accurate.
    – bwerks
    Dec 31, 2012 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.