Is there a way to monitor how an installer for Windows writes its own stuff inside the registry?
Is there also a way to monitor which files are written on the disk?
-
Sandboxie won’t “show” you what registry keys are written, but it will keep them in a separate file that you can open in a text editor– Cole TobinJun 22, 2018 at 15:02
-
There are plenty of filewrite and regwrite tracking programs!– RozzAJun 22, 2018 at 22:38
Add a comment
|
4 Answers
Revo Uninstaller will track an installation and show you all files and registry entries that are written during an installation.
Use Process Monitor for this purpose. RegMon and FileMon are merged into this and it can now be used to monitor process, registry and files.
Use a software that does Registry Snapshots like RegShot2.
Regshot2 Unicode is a registry change and file system change detection diff tool that takes snapshots, generates HTML reports, and creates automatic REG undo/redo scripts. The program can save/load snapshots to file for later use, while registry path and file path inclusion/exclusion rules can be set to include/exclude paths in the snapshots.
- Do a registry snapshot
- install the software
- do a 2nd snapshot and let the software compare the 2 snapshots for diffs.
Now you see the new/altered registry settings.
answered Jun 22, 2018 at 13:45
-
Problem with this approach is that Windows also writes a ton of things to the registry, and it's hard to find what was written specifically by an installer. Oct 28, 2020 at 20:30
The best tool for this is process explorer by Windows Sysinternals. It's free tools that can view file and registry handles of any program running on the system.
Here's the link:
https://docs.microsoft.com/en-us/sysinternals/downloads/process-utilities)
