To investigate how a Windows application works, I need a software that will take a snapshot of the whole disk, including the registry and hidden/protected files, take a second snapshot after running the application, and show what changes were made.

I tried the free WhatChanged, but it takes a very long time to compute the changes.

Does someone know of a good application, either open-source or commercial?


Edit: I also tried InCtrl5, but it seems to miss some files.


Edit: For those looking for the same kind of application, RegShot can take snapshots of the Registry and the file system.

link|improve this question

60% accept rate
Is this continuing in your quest to circumvent the protection on the software on your other question for which a paid version has been suggested? – Mokubai Jun 13 '11 at 12:14
Yes. I forgot to mention that I need a much older version, which is no longer for sale, hence the need to keep running the time-limited trial. I did offer to buy a license, but got no reply. – OverTheRainbow Jun 14 '11 at 10:26
feedback

2 Answers

Check DiskPulse: http://www.diskpulse.com

It will show you all file system changes in real-time.

link|improve this answer
feedback

Try Process Monitor.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.