44

I would like to find the changes made in the registry after installing something on my computer. However I would like to also know what can be done with ease as a general procedure.

0

6 Answers 6

40

Run the installer and watch it with Sysinternals Process Monitor. You can filter the data so that only operations done by the installer are shown. You can even filter down to whatever operations you want to see (RegWrite, RegQueryValue, etc) and save the capture for later viewing.

alt text

Process monitor is freeware.

You could also use WinDiff. You can save exported registry files and then compare them afterwards:

alt text

WinDiff is free and open source.

Another FOSS solution for comparing actual registry exported files is RegShot.

RegShot is a small registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one - done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2.In addition, you can also specify folders (with sub filders) to be scanned for changes as well.

alt text

4
  • Is RegShot fast (those registries can be quite big)
    – Notitze
    Dec 6, 2009 at 21:09
  • About the same speed as exporting the registry, a couple seconds. The comparison feature only takes a few seconds too. It's very fast.
    – user1931
    Dec 7, 2009 at 2:27
  • 1
    Regmon/Procmon is not ideal because there is far too much clutter that needs to be manually filtered. Also, Windiff cannot handle giant .reg files, WinMerge works better for that, and can even diff them better than Windiff. That said, I usually use this method for quick and dirty analyses (even though it usually ends up being more work).
    – Synetech
    Jun 3, 2012 at 21:55
  • 3
    RegShot seems to be not of any use if you already have registry snapshots and need to compare them
    – user172353
    Dec 6, 2012 at 13:54
8

if you happen to have Total Commander, this is pretty easy:

  1. export the registry before the installation and after the installation (save with the same name in different folders)

  2. open both folders in Total Commander, highlight the file on one side, go to Files > Compare By Content... voilá:

enter image description here

Total Commander is shareware, try before you buy.

0
5

If you want to compare two registry files (that you have manually exported to text), then there are plenty of comparison apps, such as WinMerge, WinDiff, etc.

A word of caution: if the registry hive is large, then exporting can take a while, and worse, Windiff can more or less hang when trying to read large .reg files. Use WinMerge instead because it can handle large files, diff them faster, and the results are better (sometimes Windiff just gets it wrong).


If you want to compare the registry before and after an installation, then you may as well use an installation monitor. Again, there are plenty of them, but one of the main ones is PC Magazine’s InCtrl5 (you may have to pay to download it from their site, though the program itself is free, so there are plenty of sites that have it). They have released an update called InCtrlX which presumably, is better. Total Uninstall is a good commercial one. I generally like my old copy of InCtrl5, but Z-Soft Uninstaller has the same function and is exceptional (it’s the best of the dozen or so that I have tried); plus, it’s free.


Another solution is to analyse the installer itself. That is, look inside the EXE/MSI/BAT/INF/etc. file to see for yourself exactly what it does when it installs, including changes to files, registry entries, services, drivers, and such. That way you can avoid the whole detection process altogether. I find that 7Zip is the best way to look inside most executable installers (such as NSIS), because you can see the files and scripts and such. For MSI installers, I suggest either Microsoft’s own ORCA or InstEd. A good commercial tool for MSIs is AdvancedInstaller

2
  • WinMerge takes about 30 seconds for a whole Windows7 registry comparizon, not bad. May 21, 2013 at 9:53
  • @NicolasRaoul, aside from the CPU power of the system, comparisons also depend heavily on the amount of difference. I have compared 100MB+ text files that were only slightly different in just a few seconds with WinDiff and 100KB files that were very different in hours with WinMerge (I usually end up killing the process long before that).
    – Synetech
    May 21, 2013 at 14:36
2

I use WinMerge but I have built an application to convert WinMerge patch files to .reg format. It works great for non-M$ apps, but since WinMerge doesn't maintain HK in generated patch files, mostly just for install/uninstall uses. I had one application in particular that I couldn't install on x64 Win7, but I knew it worked. I exported entire reg to file1, installed, exported entire changed reg to file2. Make a comparison patch with WinMerge then used my application to clean up all the unecessary content.

WinPuurg

1

I wanted to compare actual hives and not exported files and to be able to easily copy things between them.

I tried:

  1. Registrar Register Manager It has a built in comparison function that will compare hives that you have loaded. However, I could not find a simple way to copy the missing/changed items from one hive to another and did not receive any answer from their customer support, so I gave up trying with it.
  2. Beyond Compare The professional version will also compare hives that you have loaded. (You will need to load them with regedit or some other tool.) Once you have done that the comparison tool easily allows copying the missing/changed items from one hive to the other (and when you have highlighted an item, knows that the copy button should copy it to the other hive). It can copy whole subtrees or individual keys, but you must select the subtree (or key) you want copied. There were some keys it would not let me copy. I assume that they were locked by some protection mechanism of the registry system itself.

So, here is the steps I used in detail. Assume that I want to copy items from the registry on partition D (hive SOFTWARE) to the registry partition E (hive SOFTWARE) while running from partition C.

  1. run regedit (booted as partition C)
  2. select HKEY_LOCAL_MACHINE
  3. from the File menu, pull down LOAD HIVE
  4. browse to D:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE (load that hive) name it d-software
  5. pull down LOAD HIVE again.
  6. browse to E:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE (load that hive) name it e-software
  7. run beyond compare
  8. pull down NEW SESSION/REGISTRY COMPARE
  9. in left pane address box enter reg:\HKEY_LOCAL_MACHINE\d-software
  10. in right pane address box enter reg:\HKEY_LOCAL_MACHINE\e-software
  11. wait while it colors the items below (it's doing the actual comparison)
  12. select a blue (missing) or red (different) item on the left side
  13. if you want to copy it, use the arrow in the tool bar, which will copy it to the right side
  14. if you select an item on the right side, it will copy it to the left side.
  15. when done, close both applications
1

RegistryChangesView

RegistryChangesView is a tool for Windows that allows you to take a snapshot of Windows Registry and later compare it with another Registry snapshots, with the current Registry or with Registry files stored in a shadow copy created by Windows. When comparing 2 Registry snapshots, you can see the exact changes made in the Registry between the 2 snapshots, and optionally export the Registry changes into a standard .reg file of RegEdit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .