Is there a way to see all files and registry entries that an application installs?

Question

I am trying to figure out if there is a way to basically install an application into a sandbox, so that I can easily see all files it created and all registry entries it added without searching the computer looking for files.

It doesn't need to be a sandbox, as long as it will tell me everything the installer has done. Surely there has to be something out there that does this. I know my A/v tells me when it accesses certain files and folders, but I am looking for a more precise approach that logs everything so I can analyze it after.

Answer 1

1. Download, unpack and run Process Monitor.

2. Run your installer. I'm using FileZilla for this example.

   

3. While the installer runs, you can use the crosshair and drag it onto the installer window. This will create a filter which results in Process Monitor only showing events relating to that process.

   

   You can also wait for the installer to finish and pick it out of the recorded events yourself. You can right-click the Process Name and create an Include filter easily.

4. You will now have a log of every file system or registry access of the installer. You can now create additional filters to further analyse the data or use the functions available from the Tools menu.

   Especially File Summary and Registry Summary might be of interest in this context.

   

However, note that when filtering events for a specific process only, you might miss operations that aren't directly caused by the installer process itself. The installer could call some Windows API that indirectly causes registry values to change.

Likewise, the installer could just spawn a child process that makes file and/or registry modifications. This child process also wouldn't be seen when you only filter on the parent process.

When a process spawns a child process, this will be indicated by the Process Create operation in Process Monitor.

Answer 2

I think you might be looking for something like Total Uninstall

This software needs to be installed prior to the application you would like to monitor.

It maintains a log of all the registry entries and files created and changed.

It provides a GUI for navigating the freshly installed and monitored programs.

Answer 3

1. Export the entire registry before the install
2. Export the entire registry after the install

Use a file diff to get the differences between the two registries.

http://support.microsoft.com/kb/171780

You can download software to do it for you (see below)

http://www.aplusfreeware.com/categories/util/registry.html

Another thing you can do is to download "Sysinternals Process Monitor". Then you can filter the operations done by the installer are shown. You can even filter down to whatever operations you want to see (RegWrite, RegQueryValue, etc) and save the capture for later viewing.

Answer 4

A more user-friendly way than ProcessMonitor is to use an actual install-monitoring program. The one that I have always used and preferred is PCMagazine’s InCtrl5. It used to be free and while they started charging for their utilities several years ago, you may still be able to find a copy from someone who downloaded it while it was free and had the free license. They have also updated it to InCtrlX which is presumably better, but not free.

Another one that I like is ZSoft Uninstaller. Of the dozens of such programs that I have tested, this was the next best to InCtrl5. It’s also free.

These programs work by taking a snapshot of the registry and file system before and after the installation, then doing a comparison to find out what has changed (added, removed, modified). Unlike a program like ProcessMonitor which simply monitors system accesses, these filter for actual changes to the system and the better ones even filter out false positives like temporary files and OS-initiated changes.

Answer 5

Maybe, if installer exports keys directly to registry then this can be captured with RegFromApp (x86) or (x64) ran as Administrator, but usually installers evoke other installers and so this does not work very often.

If that doesn't work, there Total Uninstall Professional is best but not free and Zsoft Uninstaller is free but adds further complication.

One critical thing to note, HKEY_ROOT is not an independent registry entity but a combination of part of local machine and current user. Thus it is sufficient to gain Local Machine and Current User entries. Software stuck in the past don't know this like sysTracer, but software with the times like Total Uninstall or Zsoft Uninstaller know this.

For simplicity let's say you can acquire Total Uninstall Professional. You take a snapshot before install and after install. You can take export local machine registry entries. But Current User entries are instead formatted as HKey-Users entries and will need some reformatting on your part (find/replace) style. For example, you would replace:

HKEY_USERS\S-1-5-21-2940598271-2218309987-103824483- 
1001\SOFTWARE\FileConverter

with

HKEY_CURRENT_USER\SOFTWARE\FileConverter

The reason for this is to make the reg file compatible with all machines. S-1-5-21-2940598271-2218309987-103824483-1001; this refers to a specific machine. Though you can't keep an unconverted entry that specific system above, you can keep one that references S-1-5-18; which is a special key.

The process is similar but more complicated with Zsoft Uninstaller because it doesn't export the reg files and the best you can do is convert their Show Recorded Info file to work with: regexport (which must export entire keys whereas registry entries often refer to specific data within a key).

Answer 6

You can use VMware ThinApp to install an application in a sand box. It will record and virtualize your application in a separate folder where you can monitor all of its contents. Here is the link:

http://www.vmware.com/products/thinapp/