I'm solving a problem - I'm installing software on Windows and it makes the system unstable for some reason. Windows starts crashing soon after. I want to know what changes it made to the registry and also to the file system.

Does anyone know a tool that I can use to snapshot state of the file system and registry? Like all the keys, and files on the file system. Then after I install software I'd like to diff the new registry and the old (and also the file system) to get more ideas about what could be going wrong.


Here are some ideas. Ive used regshot before and it worked well



You could run Sysinternals Process Monitor which allows monitoring file system, registry and process/thread activity in real-time. You can also set filters that allows you to monitor just the installer, which helps to rule out changes made by other processes.

Of course it doesn't track previous changes, so you have to run it during the installation.

The tool is free and you can download it directly from Microsoft.

  • I tried this but it doesn't give a good overview of the results. You end up with 10,000 line long logs that you have to spend hours processing. I'm looking for a better solution that has a nice GUI and already solves this. I know there are such tools out there. – Boda Cydo Mar 16 '15 at 13:58
  • 3
    Process Monitor is that tool. You just need to use the filters: limit it to your installer and only to writes. No program will do your job in recognizing the anomalities. – Esa Jokinen Mar 16 '15 at 14:09
  • There are better tools for this that create snapshots before the install and after and then display the changes in neat user interface. Process Monitor is a hardcore tool for masochists. It produces tens of thousands of lines of logs that no human can interpret. I already spent several hours trying to make sense of the output. Limiting it to installer is just one part of using it. The installer spawns helper processes that have to be filtered too. – Boda Cydo Mar 16 '15 at 14:31
  • 3
    Apparently I am not a human being, but a sysadmin. Q.E.D. – Esa Jokinen Mar 16 '15 at 14:35
  • 1
    If you only care about registry writes, I'm pretty sure Process Monitor wouldn't output 10k registry writes, unless the setup is totally bonkers or there are lots of other processes writing things in. Really, it doesn't take much to filter only registry writes and only run the setup proess. But if you don't want to/know how to use it, it doesn't mean it's useless or nobody else can use it. – Sami Kuhmonen Mar 17 '15 at 13:02

Look into something like one of the snapshot based package creators. Emisoft makes some. Cameyo is a app visualization platform, but will get the same info for free.

  • What does this have to do with snapshot based package creators? I'm looking for registry/filesystem diff/snapshot comparison tool. – Boda Cydo Mar 16 '15 at 13:59
  • 1
    When you capture an install, it will usually allow you to see, in a nice "Psudo" Registry and File tree structure the additions to the system from the installer. As above, just watching the registry changes in Process Monitor is basically unusable. – jmp242 Mar 16 '15 at 20:01
  • Amazing that this was downvoted. Tools that take snapshots for packaging purposes are some of the best I've ever seen for presenting very complex sets of changes in a simple and digestible way. @BodaCydo, if you're not even going to give people's answers a chance, at least have the courtesy not to actively try to hurt their community rep. The answer is not off topic. – Brian Cline Sep 24 '17 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.