How to determine/audit which files, registry, dll, etc. are installed

[ECE]

Hi,

I'm trying to audit a particular software install to determine what files, registry, dll, etc. gets copied to my machine. I've search low and high for something that can do this, but no luck.

Any suggestions?

Thanks!!!

 

[Bubbaleone]

There are a lot of ways to manually accomplish what you're trying to do but most of them require a fair degree of proficiency in using registry snapshots, and usually two seperate tools for making before and after file/registry change comparisons. Sysinternals "Autoruns" can accomplish this alone, but it still requires you to take before and after snapshots and understand how to analyze them. For something more user friendly you can monitor an installation, from the instant you start the program installer until that installation is completed, using an uninstaller program.

Many of the "uninstaller" type programs (both freeware and paid) claim that they're capable of accurately monitoring all the changes an installation makes, and over several years I've tested these claims by comparing their results to the results obtained with Sysinternals Autoruns. When compared against Sysinternals Autoruns, Revo Uninstaller Pro is the only uninstaller software I've tested (and use regularly) which will accurately track every file and registry change that occurs. It's available as a full-featured 30-day free trial.

.

 

[ECE]

Wow, cookie for you! Didn't realize I had to look for an uninstaller program. I was searching for installer audit software instead.

Time to test out Revo on my app in a VM environment.

Thanks!!!!

 

[Savatar]

Alternatively, you can use process monitor, which will let you filter for specific process names (like the installer). This will show all the registry keys and files that the installer (or specified process) touches during the install (have to start it just before you start the installer)... just be sure to 'stop' data collection when it's done installing, b/c it can generate a lot of events. (Filters are practically a requirement to refine the results to just the data you want to look at, because it generates a lot of data)

It's actually pretty useful when you have inherited strange applications that you have to troubleshoot/support and you have no idea what it does.

Process Monitor description and download link: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

 

[ECE]

Thanks Savatar!!!!