5

Question

Is there a decently-priced (free preferred) tool that will allow me to see all changes made to a system (disk, registry, etc.) during the process of an install?

Background

I would like to capture changes made by a software installation so that I can forward them to a security team who will be able to white-list and authorize those actions.

At the current time, if an install makes changes to the user's documents folder or adds a registry key, we don't have a good way of picking that up. And I know there must be a better way.

Thanks in advance for any help you can give!

Improve this question

3 Answers 3

Reset to default
2

There are several ways of accomplishing this. One of my favorites is using WinInstall LE (a free product which has changed hands many times over its lifetime) to capture the installation package. The same pre / post snapshot method is available in many products. It'll detail exactly what changes are being made.

You can also use a couple of the sysinternals tools to do the same thing but it tends to have more background noise.

Improve this answer
1
  • Your link seems to be broken. Scalable apparently change its product name (and price ?), you can see it here
    – Trajan
    Commented Sep 17, 2015 at 14:45
2

I haven't used it personally, but I have a few developers who vouch for it; ZSoft Uninstaller. It's free.

Here's a walk-through for it too!

Improve this answer
2
  • 1
    Maybe you would like to include the name of this mystery program.
    – wfaulk
    Commented May 10, 2012 at 22:23
  • ...Maybe........
    – JohnThePro
    Commented May 10, 2012 at 22:27
-1

I've been using What Changed.

Its small, portable, fast, and free. It does an 'actual' before and after scan. This should produce a report suitable for your auditors.

Improve this answer
7
  • 1
    How is WhatChanged "fast"? It took it more than FIVE HOURS (I'm not sure how many, because after five hours I left it running and went to sleep) to snapshot and compare a 120GB SSD system, with a 2.67GHz CPU. What took longest was actually comparing the registry snapshot after installing the target software. That took at least FOUR HOURS. This is ridiculous, as dumping the registry before and after and doing a diff should take less than a minute.
    – Dan Dascalescu
    Commented Dec 3, 2012 at 3:34
  • 2
    Update: I looked at the logs. It took WhatChanged EIGHT HOURS to finish comparing the "after" state with the "before" snapshot. The bulk (SIX HOURS) was the comparison of registry keys. Maybe this is because WhatChanged stores the entries in line-based files instead of, say, SQLite. As far as files are concerned, WhatChanged stores the snapshot, again, as comma-separate <filename>,<size> (not a checksum!) entires. By far, the worst Windows system snapshot comparison tool I've ever seen, despite its portability and small footprint.
    – Dan Dascalescu
    Commented Dec 3, 2012 at 6:14
  • Also, no Windows-specific intelligence to exclude irrelevant changes, like HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs. @RobW, can you please amend this answer? I'd vote it down, but don't have the reputation yet.
    – Dan Dascalescu
    Commented Dec 3, 2012 at 6:16
  • 2
    Baseline collection was okay; what took inexplicably longer was the second registry snapshot and comparison. While in the vast majority of cases I do notify the developers, due to the systemic flaws that I mentioned in my comments #2 and #3, I didn't bother in this case. BTW I noticed you haven't really said how fast WhatChanged was in your case. My mileage was one install that created 4 files and changed relatively few registry keys, compared to the size of the registry.
    – Dan Dascalescu
    Commented Dec 6, 2012 at 14:34
  • 2
    Dan's criticisms, while flamey, sound like they're totally justified if what he's saying is accurate.
    – bwerks
    Commented Dec 31, 2012 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .