3

I'm solving a problem - I'm installing software on Windows and it makes the system unstable for some reason. Windows starts crashing soon after. I want to know what changes it made to the registry and also to the file system.

Does anyone know a tool that I can use to snapshot state of the file system and registry? Like all the keys, and files on the file system. Then after I install software I'd like to diff the new registry and the old (and also the file system) to get more ideas about what could be going wrong.

Improve this question

3 Answers 3

Reset to default
2

Here are some ideas. Ive used regshot before and it worked well

https://www.raymond.cc/blog/tracking-registry-and-files-changes-when-installing-software-in-windows/

Improve this answer
4

You could run Sysinternals Process Monitor which allows monitoring file system, registry and process/thread activity in real-time. You can also set filters that allows you to monitor just the installer, which helps to rule out changes made by other processes.

Of course it doesn't track previous changes, so you have to run it during the installation.

The tool is free and you can download it directly from Microsoft.

Improve this answer
7
  • 1
    I tried this but it doesn't give a good overview of the results. You end up with 10,000 line long logs that you have to spend hours processing. I'm looking for a better solution that has a nice GUI and already solves this. I know there are such tools out there.
    – Boda Cydo
    Mar 16, 2015 at 13:58
  • 3
    Process Monitor is that tool. You just need to use the filters: limit it to your installer and only to writes. No program will do your job in recognizing the anomalities.
    – Esa Jokinen
    Mar 16, 2015 at 14:09
  • 1
    There are better tools for this that create snapshots before the install and after and then display the changes in neat user interface. Process Monitor is a hardcore tool for masochists. It produces tens of thousands of lines of logs that no human can interpret. I already spent several hours trying to make sense of the output. Limiting it to installer is just one part of using it. The installer spawns helper processes that have to be filtered too.
    – Boda Cydo
    Mar 16, 2015 at 14:31
  • 4
    Apparently I am not a human being, but a sysadmin. Q.E.D.
    – Esa Jokinen
    Mar 16, 2015 at 14:35
  • 1
    If you only care about registry writes, I'm pretty sure Process Monitor wouldn't output 10k registry writes, unless the setup is totally bonkers or there are lots of other processes writing things in. Really, it doesn't take much to filter only registry writes and only run the setup proess. But if you don't want to/know how to use it, it doesn't mean it's useless or nobody else can use it.
    – Sami Kuhmonen
    Mar 17, 2015 at 13:02
3

Look into something like one of the snapshot based package creators. Emisoft makes some. Cameyo is a app visualization platform, but will get the same info for free.

Improve this answer
3
  • What does this have to do with snapshot based package creators? I'm looking for registry/filesystem diff/snapshot comparison tool.
    – Boda Cydo
    Mar 16, 2015 at 13:59
  • 1
    When you capture an install, it will usually allow you to see, in a nice "Psudo" Registry and File tree structure the additions to the system from the installer. As above, just watching the registry changes in Process Monitor is basically unusable.
    – jmp242
    Mar 16, 2015 at 20:01
  • Amazing that this was downvoted. Tools that take snapshots for packaging purposes are some of the best I've ever seen for presenting very complex sets of changes in a simple and digestible way. @BodaCydo, if you're not even going to give people's answers a chance, at least have the courtesy not to actively try to hurt their community rep. The answer is not off topic.
    – Brian Cline
    Sep 24, 2017 at 3:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .