33

I am trying to figure out if there is a way to basically install an application into a sandbox, so that I can easily see all files it created and all registry entries it added without searching the computer looking for files.

It doesn't need to be a sandbox, as long as it will tell me everything the installer has done. Surely there has to be something out there that does this. I know my A/v tells me when it accesses certain files and folders, but I am looking for a more precise approach that logs everything so I can analyze it after.

1
  • You can audit registry changes in Windows 7, but that depends on the specific version used. Oct 15, 2013 at 20:09

5 Answers 5

35
  1. Download, unpack and run Process Monitor.

  2. Run your installer. I'm using FileZilla for this example.

    enter image description here

  3. While the installer runs, you can use the crosshair and drag it onto the installer window. This will create a filter which results in Process Monitor only showing events relating to that process.

    enter image description here

    You can also wait for the installer to finish and pick it out of the recorded events yourself. You can right-click the Process Name and create an Include filter easily.

  4. You will now have a log of every file system or registry access of the installer. You can now create additional filters to further analyse the data or use the functions available from the Tools menu.

    Especially File Summary and Registry Summary might be of interest in this context.

    enter image description here

However, note that when filtering events for a specific process only, you might miss operations that aren't directly caused by the installer process itself. The installer could call some Windows API that indirectly causes registry values to change.

Likewise, the installer could just spawn a child process that makes file and/or registry modifications. This child process also wouldn't be seen when you only filter on the parent process.

When a process spawns a child process, this will be indicated by the Process Create operation in Process Monitor.

4
  • Hi Oliver, thanks for the detailed tutorial. I really appreciate it. I am just uninstalling the software and will try it right after when I reinstall. I will keep you posted on how well it works for me. Oct 15, 2013 at 21:42
  • Wow, this answer puts mine to shame. +1 for you!
    – MonkeyZeus
    Oct 16, 2013 at 12:12
  • I ended up taking this approach. It worked great once I got the hang of it. I realized it is best to set the filters before hand or else it takes very long to filter the objects in the listview. Oct 18, 2013 at 17:58
  • @user1632018: If you have a set of filters that it working for you, might also want to enable the Drop filtered events option from the Filter menu. Then the filtered events don't even get stored. Oct 18, 2013 at 18:13
9

I think you might be looking for something like Total Uninstall

This software needs to be installed prior to the application you would like to monitor.

It maintains a log of all the registry entries and files created and changed.

It provides a GUI for navigating the freshly installed and monitored programs.

3
  • Link-only answers are a bad fit for SU. Please provide a somewhat detailed explanation on how the program works and how it solves the OP's problem. Oct 15, 2013 at 20:00
  • It looks like a nice piece of software, but I was leaning towards a free approach. It seems promising as an uninstaller though. A while back I was looking for an uninstaller that took this approach. I ended up with Revo Uninstaller though because I couldn't find one. Revo just searches for keys and files that contain the name in them. Which isn't always accurate and can delete important registry keys if the user isn't careful. So thank you for that, If I get fed up with revo I will probably purchase this uninstaller. For this use though I am going with the Process monitor approach. Oct 15, 2013 at 21:32
  • Good luck! Certainly let us know how it goes.
    – MonkeyZeus
    Oct 16, 2013 at 12:12
7
  1. Export the entire registry before the install
  2. Export the entire registry after the install

Use a file diff to get the differences between the two registries.

http://support.microsoft.com/kb/171780

You can download software to do it for you (see below)

http://www.aplusfreeware.com/categories/util/registry.html

Another thing you can do is to download "Sysinternals Process Monitor". Then you can filter the operations done by the installer are shown. You can even filter down to whatever operations you want to see (RegWrite, RegQueryValue, etc) and save the capture for later viewing.

2
  • I am trying the process monitor approach as we speak. I'll let you know if it works well for me. Oct 15, 2013 at 21:40
  • The likelihood of another program modifying the registry in that time is too high for this approach to be reasonable Aug 19, 2015 at 3:33
1

A more user-friendly way than ProcessMonitor is to use an actual install-monitoring program. The one that I have always used and preferred is PCMagazine’s InCtrl5. It used to be free and while they started charging for their utilities several years ago, you may still be able to find a copy from someone who downloaded it while it was free and had the free license. They have also updated it to InCtrlX which is presumably better, but not free.

Another one that I like is ZSoft Uninstaller. Of the dozens of such programs that I have tested, this was the next best to InCtrl5. It’s also free.

These programs work by taking a snapshot of the registry and file system before and after the installation, then doing a comparison to find out what has changed (added, removed, modified). Unlike a program like ProcessMonitor which simply monitors system accesses, these filter for actual changes to the system and the better ones even filter out false positives like temporary files and OS-initiated changes.

1
  • +1 for InCtrl5. Very user friendly way to do this.
    – Ryan_S
    Oct 21, 2013 at 17:25
0

You can use VMware ThinApp to install an application in a sand box. It will record and virtualize your application in a separate folder where you can monitor all of its contents. Here is the link:

http://www.vmware.com/products/thinapp/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .