8 Tools to Track Registry and File Changes by Comparing Before and After Snapshots

5. InstallSpy 2

Although not quite as old as InCtrl5 above, InstallSpy dates back to 2003 but could prove useful because of the massive amount of options available for monitoring. This tool is good for not just for tracking file and registry changes during an install, but also for general execution of programs through the monitoring of shell events like file type association or attribute changes, drive or media insertion and removal, server disconnect, folder sharing and a lot more.

InstallSpy

InstallSpy runs according to a series of wizard like steps from 1 to 7. The 1st step is used to load the setup installer or application to monitor, or if you just want to track changes between 2 points in time, click the Yes button. Then proceed through the steps following what it tells you to do until the before and after snapshots have been analyzed and the differences report file opened as an HTML document.

There can be quite a lot of entries in the report file because of the amount of configuration options available so it might be a wise idea not to turn everything on thinking you’ll get a better report because of it.

Download InstallSpy


6. SysTracer

The full version of SysTracer isn’t a free tool but there is a restricted free version available. Some things including the comparing and exporting of snapshots is limited and you also can only create 5 snapshots at a time, although you can reset that by using the portable version and deleting the folder after using the program, then extracting it again. Apart from the standard files and registry, SysTracer can track a number of other items during a snapshot including system services, drivers, startup applications, running processes and loaded dlls.

systracer

SysTracer can also has a remote scan option to take snapshots of network computers although it does need installing to use this mode. Simply go to the Snapshots tab and click Take snapshot to start the tracing process. You can then select the areas of the system to scan and once complete (it will take a minute or 2), install your application.

Then click the Take Snapshot button again to create the the after snapshot, followed by the Compare button at the bottom. The Registry, Files and Applications tabs can be individually analyzed and exported, or the whole list can be exported to HTML from the Snapshots tab. There are separate 32-bit and 64-bit versions available.

Download SysTracer


7. WhatChanged

Although it’s a pretty basic tool, we thought WhatChanged was worth a mention because it’s a small self contained portable executable of under 100KB and can record the changes from selected parts of the registry and drives or folders from the single window. The program is quite similar to Regshot in its operation and easy to use, a text file with the differences will be created on completion.

whatchanged

By default both the registry and file scanning options are turned off, so you simply turn on what you need and configure the drives/folders or areas of the registry you want to track, then press the Step #1 baseline snapshot button. Then after the software install, press the Step #2 Compare button to get the after snapshot and comparison text file result.

The downside of WhatChanged is the very slow speed of the 2nd snapshot and compare which can take several minutes. It will create 4 or 5 text snapshot files in the same folder as the executable which can be deleted afterwards or by using the Clean temp files button.

Download WhatChanged


8. TrackWinstall

TrackWinstall offers two kinds of snapshot from its main window. The one click mode where it will create the before snapshot, ask you to install the software, and then create the after snapshot with the comparison between the two at the end. And the second mode offers a 2 phase process which will create the first snapshot and then save it.

Then you can install the software or perform other tasks such as having to reboot, and then return to TrackWinstall when you’re ready to take the second snapshot and complete the process.

trackwinstall

You can choose to enable or disable registry tracking and custom locations can be set for file tracking. By default file tracking is horribly slow because 2 of the 3 default locations (\Windows and \Common Files) are set up to record MD5 checksums which adds several minutes to each snapshot creation. You can delete these folders and add them in again using the quicker time stamp mode but these changes never get saved and have to be re-entered next time you run the program.

You can’t save the information in the compare differences window but can instead copy the data to a text editor etc, right clicking any entry will search Google for it. TrackWinstall is completely portable with separate 32 and 64-bit versions available.

Download TrackWinstall

34 Comments - Write a Comment

  1. Marek 5 months ago
  2. Mark 8 months ago
  3. David Maisonave (Axter) 9 months ago
    • HAL9000 9 months ago
  4. james 9 months ago
  5. Diana VB 1 year ago
  6. Andrewcamary 1 year ago
  7. Karl 3 years ago
  8. nascent 3 years ago
  9. Mario Renor 3 years ago
  10. EEE 3 years ago
    • HAL9000 3 years ago
  11. steve 4 years ago
    • HAL9000 4 years ago
  12. Mahesh 4 years ago
  13. Oscar 4 years ago
    • HAL9000 4 years ago
      • HiroPro 4 years ago
        • HAL9000 4 years ago
    • Maurice 5 months ago
  14. Paranoid Geek 4 years ago
    • HAL9000 4 years ago
  15. MATTHEW 4 years ago
  16. john klann 4 years ago
  17. Angelo 4 years ago
  18. Skrell 5 years ago
  19. Hani 8 years ago
  20. mafia87 9 years ago
  21. billy13 9 years ago
  22. mike 9 years ago
  23. philips14c 9 years ago
  24. Blackrose 9 years ago
  25. xje4bv 9 years ago
  26. Roy Raay 9 years ago

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: Your comment is subject to approval. Read our Terms of Use. If you are seeking additional information on this article, please ask in our forum or contact us directly.