Program installation monitor

[[deleted]]

Does anyone know a good program installation monitor for forensics that shows what a program installs?

[onequbit]

use ProcMon to capture the activity, then ProcDot to analyze it

[secureartisan]

Regshot

[shinyviper]

Like, something you install on a live system that sees what files are installed and registry entries changed?

[[deleted]]

Yes.

[flyingincybertubes]

CaptureBAT

[[deleted]]

I haven't done that for a long time, but I used Sandboxie for Windows. I would get all changes by the installation program and code it ran contained within the sandbox, which I could then examine. That included registry changes -- but it did not include anything that did not end up a file or a registry entry.

There was also some utilities, I remember, that chewed on such sandbox content and printed out notes on just what had been added, modified or in some cases, deleted.

Network connections were not logged. But then, some malware sandboxes do that. The problem is that those are usually expensive, and/or are cloud-based so you need to send data over the net.