Registry Snapshot Tools: 8 Best to Track & Compare Changes

Usually when software gets installed onto your computer, it copies the needed files and registry entries onto the system for the program to function properly. And when you want to uninstall the software it should but doesn’t always remove everything that was added in the first place. Most of the time there is useless data left over which should have been removed because the uninstaller maybe is corrupted or even badly programmed. Depending on the program and how good the uninstaller is, this could range from one or two innocuous registry keys right up to hundreds of keys and several Megabytes of leftover files.

One way to find out yourself what is getting added to your system during a software install is to actually check the state of your system before the installation, and then check again afterwards to see what has changed. Here’s a selection of 7 tools that can track what file and registry changes are made during a software install by creating and then comparing before and after snapshots of your system, all were tested on Windows 7.

1. Regshot unicode

Regshot is a long running utility that can quickly take a before and after snapshot of the system registry. Also in the more recent unicode version it’s gained the ability to monitor for file changes using CRC32 and MD5 file checksums although this function is turned off by default and you have to go to File -> Options -> Common Options -> and tick “Check files in the specified folders” to enable it.

Only the Windows folder is entered into the list of watched folders so you have to enter any others yourself through the Folders tab. This version also added the Connect to remote registry option.

Regshot is very much a “hands on” utility and is more for experienced or advanced users to quickly check for system changes between two different points in time. Simply create the 1st shot, install the software or run the program you want to watch, and then press 2nd shot. After comparing the differences in the 1st and 2nd shots, it will open an HTML log in your browser listing all the detected changes.

Being only a few hundred KB and portable, Regshot is an extremely valuable tool to have around. The original Regshot is still very slowly being developed and there is a recent beta with separate 32 / 64-bit and ANSI / Unicode versions that can be found at SourceForge.

Download Regshot 2 Unicode

---

2. InstallWatch Pro

InstallWatch Pro is quite an old utility which works in a similar way to RegShot in that it tracks any changes made to your registry and files between 2 given points in time although this program is more specifically designed for tracking installs. The program is quite detailed in what it can track and includes additions, deletions, or modifications to files and directories, INI files and the system registry.

The good thing about InstallWatch is the easy to read way in which the results are displayed because it behaves just like a standard Explorer window with an expanding tree view of the sections on the left. While the program is running it will detect if you run a setup installer and ask to create a before snapshot, or you can simply click the Snapshot button on the toolbar.

After install, it will ask to create the after snapshot or you can use the Analyze button. The result can then be browsed or individual sections can be exported to text or HTML. All installs are instantly accessible from the tree view and there is also a useful search function.

Download InstallWatch Pro

---

3. SpyMe Tools

This utility has something the others in the list don’t which is a function to monitor a drive or folder in real time for file changes and could prove a useful addition when doing a bit of troubleshooting. SpyMe Tools is a quite an old program but is still perfectly capable at creating before and after snapshots to watch an install or software for changes.

It does have one drawback though because there is only the facility to snapshot either files or registry, not both together, changeable in the Current Mode option on the toolbar.

Like InstallWatch Pro the interface looks a lot like Explorer so you should feel at home navigating around. The way SpyMe Tools works is slightly awkward because you have to click the Scan button and save the snapshot, install or run the software to track, then click the Scan button again and save another snapshot with a different name.

Both are then tested for changes using the Compare button and the results will show in the window. The differences between the 2 snapshots can be saved as a text file. SpyMe Tools is also a portable program.

Download Spyme Tools

---

4. InCtrl5

InCtrl5 is an incredibly old tool dating way back to the year 2000 but some users may have heard or used it before, and it can still do a job with a little bit of effort. There are one or two issues with it though which require a bit of knowledge to use the program effectively. First, unsurprisingly InCtrl5 will need to be run in compatibility mode for Windows Vista, 7 or 8.

Secondly, there is an issue with it’s output results for 64-bit users as it won’t display the Software\Wow6432Node registry keys as coming from there, but will instead show them as coming from simply Software, something to watch out for.

Using the program is pretty easy and it will track changes to the registry, drives and folders, ini files and also specific text files. Inclusions and exclusions can be configured by using the What to track buttons. After selecting the installer you want to track, it will create the before snapshot for you.

Then you install the software and press the Install Complete button to create the after snapshot and the analysis, which could take a little while. The result will then open up a window where it can be viewed or saved as HTM, TXT or CSV files formats.

Download InCtrl5

5. InstallSpy 2

Although not quite as old as InCtrl5 above, InstallSpy dates back to 2003 but could prove useful because of the massive amount of options available for monitoring. This tool is good for not just for tracking file and registry changes during an install, but also for general execution of programs through the monitoring of shell events like file type association or attribute changes, drive or media insertion and removal, server disconnect, folder sharing and a lot more.

InstallSpy runs according to a series of wizard like steps from 1 to 7. The 1st step is used to load the setup installer or application to monitor, or if you just want to track changes between 2 points in time, click the Yes button. Then proceed through the steps following what it tells you to do until the before and after snapshots have been analyzed and the differences report file opened as an HTML document.

There can be quite a lot of entries in the report file because of the amount of configuration options available so it might be a wise idea not to turn everything on thinking you’ll get a better report because of it.

Download InstallSpy

---

6. SysTracer

The full version of SysTracer isn’t a free tool but there is a restricted free version available. Some things including the comparing and exporting of snapshots is limited and you also can only create 5 snapshots at a time, although you can reset that by using the portable version and deleting the folder after using the program, then extracting it again. Apart from the standard files and registry, SysTracer can track a number of other items during a snapshot including system services, drivers, startup applications, running processes and loaded dlls.

SysTracer can also has a remote scan option to take snapshots of network computers although it does need installing to use this mode. Simply go to the Snapshots tab and click Take snapshot to start the tracing process. You can then select the areas of the system to scan and once complete (it will take a minute or 2), install your application.

Then click the Take Snapshot button again to create the the after snapshot, followed by the Compare button at the bottom. The Registry, Files and Applications tabs can be individually analyzed and exported, or the whole list can be exported to HTML from the Snapshots tab. There are separate 32-bit and 64-bit versions available.

Download SysTracer

---

7. WhatChanged

Although it’s a pretty basic tool, we thought WhatChanged was worth a mention because it’s a small self contained portable executable of under 100KB and can record the changes from selected parts of the registry and drives or folders from the single window. The program is quite similar to Regshot in its operation and easy to use, a text file with the differences will be created on completion.

By default both the registry and file scanning options are turned off, so you simply turn on what you need and configure the drives/folders or areas of the registry you want to track, then press the Step #1 baseline snapshot button. Then after the software install, press the Step #2 Compare button to get the after snapshot and comparison text file result.

The downside of WhatChanged is the very slow speed of the 2nd snapshot and compare which can take several minutes. It will create 4 or 5 text snapshot files in the same folder as the executable which can be deleted afterwards or by using the Clean temp files button.

Download WhatChanged

---

8. TrackWinstall

TrackWinstall offers two kinds of snapshot from its main window. The one click mode where it will create the before snapshot, ask you to install the software, and then create the after snapshot with the comparison between the two at the end. And the second mode offers a 2 phase process which will create the first snapshot and then save it.

Then you can install the software or perform other tasks such as having to reboot, and then return to TrackWinstall when you’re ready to take the second snapshot and complete the process.

You can choose to enable or disable registry tracking and custom locations can be set for file tracking. By default file tracking is horribly slow because 2 of the 3 default locations (\Windows and \Common Files) are set up to record MD5 checksums which adds several minutes to each snapshot creation. You can delete these folders and add them in again using the quicker time stamp mode but these changes never get saved and have to be re-entered next time you run the program.

You can’t save the information in the compare differences window but can instead copy the data to a text editor etc, right clicking any entry will search Google for it. TrackWinstall is completely portable with separate 32 and 64-bit versions available.

Download TrackWinstall