17

Is there a way to monitor how an installer for Windows writes its own stuff inside the registry?

Is there also a way to monitor which files are written on the disk?

  • Sandboxie won’t “show” you what registry keys are written, but it will keep them in a separate file that you can open in a text editor – Cole Johnson Jun 22 '18 at 15:02
  • There are plenty of filewrite and regwrite tracking programs! – RozzA Jun 22 '18 at 22:38
9

Revo Uninstaller will track an installation and show you all files and registry entries that are written during an installation.

19

Use Process Monitor for this purpose. RegMon and FileMon are merged into this and it can now be used to monitor process, registry and files.

8

Use a software that does Registry Snapshots like RegShot2.

Regshot2 Unicode is a registry change and file system change detection diff tool that takes snapshots, generates HTML reports, and creates automatic REG undo/redo scripts. The program can save/load snapshots to file for later use, while registry path and file path inclusion/exclusion rules can be set to include/exclude paths in the snapshots.

  • Do a registry snapshot
  • install the software
  • do a 2nd snapshot and let the software compare the 2 snapshots for diffs.

Now you see the new/altered registry settings.

0

The best tool for this is process explorer by Windows Sysinternals. It's free tools that can view file and registry handles of any program running on the system.
Here's the link: https://docs.microsoft.com/en-us/sysinternals/downloads/process-utilities)

Here's an image of the open handles of Explorer.exe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.