I'm searching for a programm that is Win7(32 and 64bit) compatible and includes as much usefull features for application forensic as possible, including:

  • File System changes
  • Registry changes

Programs like TrackWinstall or SpyMe Tools are achiving such goals.

  • Other system related changes and events (error messages etc)

DbgView is usefull to watch if the programm had any messages.

  • Dependency Analysis

Dependencywalker does a great job at this

  • Binary information

Debuggers like Ollydebug can be very usefull

  • Memory usage

It would also be interesting but not mandatory to see the memory the programm uses and be able to view it.

Probably there is no such programm but it's worth a try. Thanks :)


I would recommend Process monitor for the file system changes, registry changes, etc, and HeapMemView for viewing the program's memory.


The Sysinternals applications can do a lot of those: http://technet.microsoft.com/sysinternals

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.