2

I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including:

  • File System changes
  • Registry changes

Programs like TrackWinstall or SpyMe Tools are achiving such goals.

  • Other system related changes and events (error messages etc)

DbgView is usefull to watch if the programm had any messages.

  • Dependency Analysis

Dependencywalker does a great job at this

  • Binary information

Debuggers like Ollydebug can be very usefull

  • Memory usage

It would also be interesting but not mandatory to see the memory the programm uses and be able to view it.

Probably there is no such programm but it's worth a try. Thanks :)

Improve this question

2 Answers 2

Reset to default
3

I would recommend Process monitor for the file system changes, registry changes, etc, and HeapMemView for viewing the program's memory.

Improve this answer
2

The Sysinternals applications can do a lot of those: http://technet.microsoft.com/sysinternals

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .