Slashdot Mirror
Good Freeware System Snapshot Tool For Windows?
Khyber writes "I'm doing a little personal research into a project that tracks what changes get made to your system every time you install a program. I know there are ways of checking through Windows Restore Points, but that's not what I'm trying to do. Instead, I'm going to start with an absolutely fresh Windows XP install, take a full snapshot of the entire installation on the hard drive, and burn that to a DVD (somewhat like a backup disc with an entire snapshot of my hard drive's current contents.) With every program I install, I'm going to take another snapshot, burn to DVD, and repeat the process until I have recreated every step taken to get to my current system state (all programs installed on a separate hard drive, all registry entries etc on the OS drive, with only snapshots of the OS drive being recorded.) The purpose for all of this I'm not legally allowed to talk about, due to confidentiality requirements. Does anybody know of such a program, preferably freeware, that will accomplish my objective, and are there tools that can be used to compare the difference in drive images?"
Wow, quiet in here.
FOG, aka Free Open Ghosting, at www.fogproject.org, will certainly take images of your hard drives; that's not a problem.
And, I haven't played with it, but it has the capability to do install packages, so that meets the bit-by-bit portion of things.
Like most open-source packages, FOG improves constantly, and recently, it's getting better by leaps and bounds.
stored on computers from birth to the grave
Depending on how long you need to keep the backup, Acronis makes some great imaging utilities with free trials
I have the heart of a child. I keep it in a jar
...but then I'd have to kill you. You know, confidentiality agreements and whatnot...
The best tool I have ever used is Prism Deploy.
It isn't free, but they do have a free trial. I've tried a number of programs to package executable programs and manage Windows images, but nothing has come close.
I'm really interested to see if there are any freeware programs that come close.
If all you need is an indication of what files
have changed, then just use rsync --only-write-batch=FILE
http://samba.anu.edu.au/ftp/rsync/rsync.html
If you need more detailed descriptions (especially for registry changes) you may want to export the registry files in a pre-script, then diff the registry entries.
The hard drive snapshot/comparison is easy enough with any number of *nix tools. The most straightforward would be cp and diff. In short: have a clean copy with an export of the registry (IMPORTANT!) in a fixed location. Make your changes, re-dump the registry. Reboot to Linux, copy everything, then create a diff with the original clean copy. As far as I know, that would be sufficient.
The easiest way is to run dual boot Fedora/XP. It will take you all of a couple of hours to install Fedora/Ubuntu/Whatever from a Live CD, partitioning the drive as required during the install. You can then backup the whole Win partition without Windows locking any files and what-not. Another approach is to add in another disk for that purpose, maybe a USB thumbdrive if your OS can boot from it.
The other approach is to use a VM machine. There are some cut-down versions of XP designed to work well in them.
WinINSTALL LE
Download
More
knoppix + dd
Sounds like a virtual environment is exactly what you need.
Personally, I use Ghost for imaging and if I want to find out what a program is doing, I run sysinternals File Monitor and Registry Monitor. They're real-time and don't record in a nice format but nothing really beats them on Windows. They've helped me diagnose hundreds of horrible modern and ancient installation programs used in an educational environment to allow network installation (why, exactly, do you need write access to C:\WINDOWS to run a Shockwave-based game for toddlers, etc.?).
Linux/Unix has this much easier because it allows you to monitor EVERYTHING without massive binary blobs having settings stored in them, having settings locked to particular machines, etc. or things generally getting in your way. Windows, it's a pain in the proverbial.
Even a lot of the professional MSI-Builders with their "discovery" modes are absolutely useless at working out what was actually a vital change and what was just the installer playing about, or the user changing their screensaver / explorer view preferences while they installed etc. I spend half my life cleaning MSI's of unnecessary cruft and inserting the entries that they miss. About 50% of automated install captures like this are useless for deployment to a different machine.
Basically, despite the "secrecy" around your particular purpose (why did you have to mention that at all... it makes no difference to what you want and adds nothing to our knowledge), it's probably not worth the hassle. Before and after snapshots, or package the programs and MSI's and you'll find out everything you need along the way, with an actual, practical result at the end. Trying to diff a filesystem/registry image in any way is madness and is only useful if you can get a *perfectly* clean machine, a VERY good automated program to do it brilliantly, where you'll end up with a lot of cruft that isn't related to the program installation at all (e.g. event log entries, temporary files, taskbar icons saving their settings etc.).
Do the install in a virtual machine like VirtualBox or similar. Then you can do as many snapshots you like directly.
c++;
Live Linux CD + dd + sdiff
How tough was that?
Well, I havn't read the article, but just hit prt-scr! Although, some computers require you too hit function+prt scr. Of course, linux and OSX have better screen shot tools built in. Linux also has GIMP, which does shots! Yup, clearly the answer is 'switch to linux'!
... *sigh*
Seriously, do we even need an article on this?
... I wonder how important the article is after all, but I'm too lazy to read it
Quartz Extreme and Core Image. Are there any other real reasons to spend all that money on generic hardware?
I would recommend regshot at sourceforge. GPL'd.
1. Install program on Windows 2. Boot to linux live cd of your choice 3. cat inputdevice > outputdevice 4. Repeat steps 1-3 as needed 5. diff 6. ????? 7. NDA'd
NTBackup
You might of course just use any hard drive imaging tool, but this is rather slow and clumsy, and it will use a lot of disk space (which isn't necessarily a problem if you really wanna burn a DVD every time). It might be easier and quicker to use one that supports incremental backups. I like Acronis True Image a lot but it is not free.
If you mainly want to document changes done to a running system over time, virtualisation products might fit your purposes well. Most of them have some sort of ability to make snapshots. The popular free VMware Server only allows a single snapshot, but Sun's xVM is every bit as good and does multiple snapshots easily.
I was looking into taking a snapshot of a fresh+patched windows install because I was tired of reformatting and then spending hours reinstalling+patching.
I checked out http://www.partimage.org/ which seems to be the tool targeting what you're trying to do.
For me, it didn't work out because the only apparent way to burn an image to disc is to have DVD+RW media and I didn't have the patience to wait until I could get to the store to buy the rewritables.
There is very little future in being right when your boss is wrong.
Just use DD it's easy
http://www.ss64.com/bash/dd.html
Get a Linux live CD and an external USB drive. Use rsync on the virgin installation and then you can use rsync to only archive the changes from that point on. If you are really stuck on having DVDs at the end of this, you can then merge the two rsyncs (the original with the changes) and burn that to disk.
What you're aiming to do is perfectly valid but the method you describe in order to achieve your goal is horribly inefficient; I'd be hard pushed to think of a more time-consuming and difficult way to achieve your goal. My tip:
This sounds like an absolutely ideal scenario where you could benefit from virtualisation technology. Install the system you wish to "monitor" in a virtual machine. I come from the VMware world, and I can say that the snapshots feature of VMware Workstation would do exactly what it sounds like you want. Whenever you wish to capture an image of the present state of the machine, take a snapshot. Further, you can take as many snapshots as you please, these snapshots can be built on previous snapshots, and you can even have branching snapshots. Icing on the cake: only the differences since the last snapshot will be saved, so you'll save a huge amount of data versus burning complete snapshots to DVD.
What next? Simple, mount the snapshots as a drive on the host machine and diff them using the tool of your choice. I use WinDiff for basic directory/file comparison, but there's a multitude of options out there. The only problem I can imagine would be you probably can't mount multiple snapshots simultaneously from the same virtual disk, but you could get around this by just making a copy of the VHD on your HD and mounting the second snapshot off that.
By the way, there's likely other virtualisation products out there (e.g. VirtualBox) that can achieve what I described above, I'm purely using VMware Workstation as an example as it's my virtualiser of choice. Further, VMware Workstation is not free, VBox is.
Consider that when you think about the additional cost of a MAC or the learning curve of Linux....
Just boot from a liveCD, then clone the drive?
That would make sure that your clone is consistent, and since you cannot continue working with the pc while the cloning is in progress (that would certainly make it inconsistent), there is not much disadvantage in rebooting.
If you want to get fancy, install a second OS, and make a script that upon booting that OS automatically clones the first OS and then reboots. Any linux can do this easily.
Since you also have a second drive, the burning to dvd can happen later.
It is called the Shadow Copy. It will give you snapshots of the drive state periodically and all the changes (this is not Restore Points). More info can be found here...
http://sansforensics.wordpress.com/2008/10/10/shadow-forensics/
http://blogs.techrepublic.com.com/security/?p=283
Clonezilla works well to take snapshots. http://www.clonezilla.org It's written around ntfsclone.
If you are just doing one machine, the Live CD works fairly well. Otherwise, FOG is a prettier server environment.
http://www.epsilonsquared.com/
It will log and report all changes installs make.
i Use http://www.clonezilla.org/ to backup the HD. nomaly i only backup the patision were the system is on, a 100GB HD i take 20 GB for the backup then it don't take me 3-10h to install windows + programmers + setup then it only take 10 mins. to get back on and the children can play agen. fist time i say to my border nothing can go rung it took him 10 mins to fuck windows up :) he was 6 at that time
Shockwave installs system files for it to run
C:\WINDOWS\system32\Adobe\Shockwave 11
the game may of needed to install a Xtra for Shockwave
C:\WINDOWS\system32\Adobe\Shockwave 11\Xtras
I've already patented that.
Love,
Bill G.
www.novell.com
Wise Package Studio will let you install apps watching exactly what changes are made to the system - also, you can repackage the app installer pretty much automagically to then remove exactly what was installed - effectively rolling the system back to it's pre-app-install state. Comes w/ a 30 day free trial and there's plenty of documentation/guides/tutorials if you look.
Try cygin + dd.
Is free for personal use, makes images, creates a boot cd for recovery. very slick program.
*tap tap tap* this thing on?
What did you do? Sign an NDA with yourself?
Check out the Microsoft Business Desktop Deployment software. Free and pretty easy to setup and use.
Is there a reason why sysprep wouldn't work? It's already on your system I would wager.
XML is like violence. If it doesn't solve the problem, use more.
http://ping.windowsdream.com/
Can backup/restore partitions over a network or to a CD/DVD, maybe it's what you need.
Try http://www.feyrer.de/g4u/ It does full drive imaging at block level, and is free. It gzips the image, but you can unzip them and do a binary compare against them. Though storing complete drive images like this is going to be awfully painful, especially if you plan to burn them off to DVD.. As for the compare, there are a few free tools around there.
There's a tool called Ghost 4 Linux that might do what you need. You boot with the g4l disk on your backup target. You can then specify a remote server or a local storage device to create the image backup. It doesn't matter what OS is being stored as it's a physical image.
Files can be very large because it copies sectors, not files, so even deleted files can take space. To minimize this there are some disk zero utilities that will zero out the unused space on your drive.
I use it often for backing up my Windows laptops.
From what i can understand what you really want to do is compare the differences between the installations of different apps? If thats the case any old MSI packaging solution will do the trick much better and with much greater detail. They almost all have a very handy function for tracking every single thing an application does on your computer. Some, like Emcos, are very easy to use and have a very clear and consistend interface for displaying the changes made. I assume youre not after what Windows XP does but rather what installations does.
For example, buy Emco Package Manager, install it on your pristine XP install. Start Emco and put it in recording mode. Do an installation / alteration / run your evil application of choice and stop the recording. Then you have all the alterations on screen easily readable.
HTTP/1.1 400
My weapon of choice is Acronis TrueImage. Allows for complete drive imaging over a network, etc. They offer BartPE files so you can make a boot disc, though.
I use the boot CD all the time for rescue and recovery.
I would try something on download.com or just try a good google search. Seems like an interesting project. Good luck. -Steve
-Steve "The Geek" Hencye
I don't have any free tools to recommend. With that in mind...
1. Many of VMWare's commercial tools have built in capabilities for storing multiple revisions of a computer configuration in as little space as possible - each different install can be a change set keyed off a previous install. Of course, you have to stick to virtual machines for this to work.
2. For my day to day personal Windows hardware I use DriveSnapshot ( http://www.drivesnapshot.de/en/home.htm ). It can perform image backups of the running system (even the boot disk). In addition, it gives you the ability to perform Differential backups which store only the changes from the root backup. It also is able to reduce IO on the differential backup by a) only reading allocated space on the source drive and b) storing a hash file for each root backup so that you don't need to perform as much IO on the backup target volume.
You can download a 30-day-ish trial for free. After 30 days, you can still restore from those backups, but if you want to continue to back up, you need to buy it.
It has some super sneaky hackerish administrator-friendly capabilities. e.g. the same executable runs in both windows as a GUI and DOS (even a DOS floppy) as a command line, you can create network boot disks for network restores from a samba share, etc.
And lastly, the author (Tom) is good at responding to email.
-brendan
Two areas immediately spring to mind:
- the registry is probably the most important object you want to monitor, so you'll need to somehow export the registry into a diff-able format.
- windows also uses "structured storage" (basically a filesystem in a file) for a lot of things -- you'll also need to be able to export those somehow?
Get Process Monitor from Microsoft; it monitors files, registry and process/thread activity (the last of these not so interesting to you for this). There's filters you can apply so you don't have to see all the failed attempts to read registry keys.
It won't help you if your program does stuff at shutdown/startup though.
* DriveImage XML is free for personal use
* Archos True Image is not free ($50) but does support incremental image backups (which would be very useful for your needs.)
* If you have a Seagate Drive, you can use DiskWizard from Seagate (which is a version of Archos True Image.)
Either use VMWare or a tool called Process Explorer / Process Monitor. These will do what you need.
If only Windows ran on ZFS :(
Us Solaris peeps do *exactly* this. Take a snapshot immediately after install, take another snapshot after configuring the system, take any additional snapshots later...
I would post an output from zfs list showing all the snapshots taken on the root filesystem, but unfortunately slashdot's lameness filter REFUSES to cooperate telling me to use fewer junk characters :(
FreeBSD http://wiki.freebsd.org/ZFS and MacOSX http://www.apple.com/macosx/snowleopard/ will soon have proper ZFS with boot support.... and Linux's ZFS-Fuse Implementation is great. Hell, it won't be long before Windows will be the only (worthwhile) OS that will be without ZFS soon.... maybe Microsoft should abandon WinFS (oh yeah, they did) and just port ZFS over.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
...but it seems like everyone else is out of ideas.
www.martau.com - Total Uninstall
There's a free trial, though. It lets you launch an installer inside of itself and records every registry, file, etc that is changed, added or removed by the installer (can have other uses besides installers of course).
You know that the American legal system has gotten out of hand when one has to worry about breaching a confidentiality agreement for personal research.
Have you tried the free partition imaging tool from Microsoft, WDS? Build a server with DHCP, install WDS and configure PXE boot. Then, after each step, you can boot off the network and create a WIM file. The nice thing is you can mount the WIm files on "mount points" which appear as folders. This is very handy as you can then do deep analysis of the files at a bit level. You could literally compare two folders and all contents and tag only the files that have changed. of note: WDS and ImageX only capture the files. If you are doing rootkit or virus research, some of these may do some funky stuff with the file system which may not be picked up by ImageX. But Otherwise; this is a free solution with the added benefit of using the same tool (imagex) to allow you to "mount" a WIM file for analysis. HTH! Marble68
/me sips his coffee and ponders a new sig...
SpyMe tools: http://www.lcibrossolutions.com/spyme_tools.htm
use rdiff-backup for windows
only stores the diffs
makes full reports of the files that have changed each time!
I'm using macrium reflect for a similar purpose
dd, partimage, ntbackup, mkisofs, etc. There are dozens of free options to take incremental backups or snapshots of your system.
partimage seems like it might be what you're looking for specifically. I like to use the system rescue cd (http://www.sysresccd.org/), which has partimage, for this sort of thing.
They bundled a tiny copy in ADS 1.0(Active Deployment Services or something like that) as imgdeploy, at 512 KB its likely to be the smallest utility you can find for free (as in cost not code) from a commercial software company that can do basically anything ghost can do. It's block based so it should fairly flexible operating system wise. The only difficult thing is downloading the large wrapper that is ADS 1.0 and sifting through it just to get the imgdeploy.exe. The same binary does capture and deploy.
If you have a mini-me operating system like the winpe, bart or something you could wrap a .hta application to give it a smiley interface, otherwise you can figure out how to use it from the cmd prompt usage message. You don't really have to read the docs.
In ADS 1.1 I believe they replaced this with ImageX which is a small utility for creating wimages.. think swim-sandwiches.. and you'll get the pronounciation. Wimages based on the .wim (no I'm not kidding ;-) whimsical isn't it?) are file based and go hand in hand with Vista installations. They might be more to your liking if your thinking incrementals since they are file based.
There is a tar like utility for windows called str or something that is very tiny and does the streaming archive thing.
There are a bazillion answers to this.. but those should get you started.. and don't forget Bacula if you have a fast gig switch.. you probably need to get the images off and on your hard disk fairly fast.
Regsnap from LastBit Software will snapshot the entire registry and system file
lists (if you want it to) and save it out to a file. Once you make your changes
or installations you can snapshot it again and then directly compare the two files
and generate a difference file of all the changes to the system. It's a fairly
useful utility for capturing what installers/applications do to windows based
systems. Unfortunately it's not free.
I know everyone hate Microsoft, but they actually provide a free imaging tool which includes the ability to edit those images.
http://technet.microsoft.com/en-us/library/cc722145.aspx
Microsoft provides even more tools, all free.
So you say "ZFS-Fuse is great".
You're the first person i've heard say that; everywhere else i see "horribly slow" and similar comments.
I take it you've actually used ZFS under FUSE on linux?
You don't need any of those crap programs. www.epsilonsquared.com
get intallrite
It's free.
takes a snapshot of registry, ini files, file system etc... you install everything u want. (you can do every step after the bare xp install if you want, although i recommend after drivers are in properly.
it makes a single self exe file, click and you're done. Office 2003 for example took like 1 min to install tops.
want to deploy across the network? just make an oldschool batchfile and use PSEXEC from the microsoft PSTOOLS suite. (glad they bought out a good company :) )
IstallWatch is another useful one, when you want to see what those pesky setup files are up to in case you want to make some "adjustment's" later ;)
Securom or anti-piracy measures would it?
Microsoft has a tool like this called imagex, which is a free download. AFAIK you can even use Windows Setup from Vista to install said snapshot. And yes I believe it can install XP images too.
then you have to look at drivesnapshot. Drivesnapshot.de is the website, it isnt "cheap" but not expensive and worth EVERY penny. This plus the software at runtime.org for data recovery and you are set for $200
I used to work for a company in the UK and we did something very similar.
There was very old little app we ran on a VM install of XP (native company wide OS).
You'd use it to snapshot the system, then install the program, do anotehr snapshot and compare.
It would show you all the registry changes, LL's, system writes, and application files.
Using that info we'd create cumstom packages to allow AD to roll them out to machines as requested over the network.
The software was hideously old. Garrish GFX and for the life of me I cannot remmebr what it was called.
The IT dept there has been outsource to IBM now and no one remains else I'd ask them and still be using it to this day!!
Damn annoying when you know the tool exists, but google is no help :o/
You want Total Uninstall. I'm using Total Uninstall 3 and it does a scan before and after, and tells you summary and detail of all the changes, so that you can completely roll back or just see what files/folders/registry items were affected.
I have used the freeware installwatch pro software for similar purposes. It is not perfect, but allows you to take a snapshot of all files and reg keys prior to performing 'some' action (browser option change, software install, etc.). After you finish the action, you perform another snapshot and it traps the deltas across filesystem - file add, delete, modify - including .ini changes and also reg key add/del/change activities.... It also stores the deltas by whatever you wish to name the change, for future reference..
Installwatch Pro - http://epsilonsquared.com/
They have another tool, install rite, which I am unfamiliar with...
clonezilla live is a live cd, you can boot from live cd on your computer, and backup the disk or partition to the another mounted partition or remote nfs, samba, sshfs....
Are you sure *you're* not six years old?
Sounds to me that you might look into the API of Thinstall. It has to keep track of all changes so that it can run a packager. I have played with a few apps that have been created from it and they seem to work great. I imagine that if the API is good getting to that info and even tweaking it might be possible.
Sera
Slashdot, where armchair scientists get shouted down and armchair theologians get modded up.
Regsnap .. for comparing two points in time of the registry. It has the ability to create redo and undo .reg files which is quite handy.
NTBackup can use volume shadow copies and is included in XP/2003 etc. You could then restore these two or more images to a central point and do a comparison. You can also create a 'DIFF' file, which in your scenario, I believe would suit you best. i.e., NTBackup will only backup the changes from the first point in time, effectively negating the need to do some kind of md5/checksum verification of changes in the filesystem. You can simply restore the file changes to a location -- the registry will almost certainly have changed and so as such the regsnap tool i mentioned earlier.
regsnap is commercial but will run for a trial period.
goodluck
I have been using a Windows XP setup based around Faronic's Deep Freeze for the past few months now and my system is, for the most part, "bulletproof". (Believe me... I also cringe whenever anyone uses that phrase unintelligently, but until I see otherwise, this is how I term this setup)
Let me start with a little understanding of what exactly Deep Freeze does... because this is the part that I didn't grasp fully until a few months ago. It can setup a drive, or drives on your system to be what is called "frozen". Frozen meaning any changes done to the system are removed upon next boot.
The altered state of frozen is what is termed appropriately as "Thawed". Thawed meaning any changes done to thawed drives are retained.
My setup is quite simple. I have a 3 drive, 4 partition setup, which is arranged as follows:
The system drive is the only frozen drive, all information that I would need to change on a regular to semi-regular basis is moved onto other drives.
So if all of my files I need are moved onto other drives, and I have a frozen system, barring physical drive failure, almost any software change I do not want to happen, can easily be repaired by rebooting.
Thus the reason I call this my "bulletproof" setup.
Please offer your comments. :)
If your project has confidentiality requirements, that means it's not a FOSS project, it's some funded project, in which case there's budget to go to the store and buy Ghost. So, use Ghost.
DriveImageXML - Outstanding product that will image your machine live (VSS support). I use it routinely and love it. Oh, and it's free to use.
http://www.runtime.org/driveimage-xml.htm
Taking an initial and progressive snapshots are a good idea to start with and a VM tool will let you do this if you are just monitoring what software is doing. Go with Virtual PC 2007, it is free and will let you take the VHD images and later remount them as secondary drives on a VM to compare them.
However depending on your end goal, it might be better to 'also' just data mine the changes to the system. Use http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx (Process Explorer) as it tracks all the changes, including read/writes to everything on the OS from the File System to the registry specifically.
Process Explorer has been around for a while and is kept updated. It is a valuable tool for tracking what install software is doing on your system, what it is changing and touch and although it can produce huge logs of data, doing a bit of dataming on this data can produce a lot of information about system changes. (It is something crackers even use to see what keys or files are changed to store random information to unlock software, etc.)
On Windows, this is the key tool for monitoring the system all the way down.
So Virtual PC 2007 for VHD images and Process Explorer (always running) storing the data of all the changes.
This should give you everything you need.
How about looking at application virtualization technologies like Altiris's Software Virtualization Solution (SVS)? SVS allows you to capture the install of an application and see the files and registry changes it makes when installing an application. You can then save the application and all of its files and reg entries as a single file. Going further it also captures any changes made while running an application, which is also something you need to consider as some apps make further changes after running the first time. SVS is for enterprises though you can also download and use a personal version with all the same capabilities and features of the enterprise version. I use it for most applications on my home system and it is especially good for trying out new applications since you can simply delete the captured application after your done with it as easily as you delete a file! Once you have all your applications captured this way rebuilding a system is as easy as installing the OS or an image and reimporting the captured application files. Very quick and very easy! Check it out! http://juice.altiris.com/node/86
Not exactly what you were asking for, but once you have imaged the system with whatever tool you choose, you can use SVS to virtualize your software installs. There is a free personal edition, but it is also scalable to a full server deployment where you can create, push out and manage virtualized software packages.
Resources:
http://svsdownloads.com/
http://juice.altiris.com/ev
-lumenistan
Many posters have already listed excellent tools for creating a snapshot offline.
From what you've described, however, it sounds like you might be interested in something that can take a snapshot of a Windows PC while Windows is running.
DriveImage XML is free for personal use
http://www.runtime.org/driveimage-xml.htm
If you need something commercial and you don't mind spending $40, then Image for Windows is also an excellent choice:
http://www.terabyteunlimited.com/purchase-image-for-windows.htm
I just found out about this yesterday, and I have not tried it myself yet, but apparently, Seagate has an OEM version of TrueImage for use with Seagate hard drives. They call it "Seagate DiscWizard". I really don't know if they've kept the cool live disc image feature or not... I'll find out later today when I try it.
http://ping.windowsdream.com/ Works great!
there is only one: dd
Sysmantec Live System Restore (the desktop version) costs 50 bucks and can be set to take an image based on triggered events. It rocks and I use it everywhere on tons of clients PCs. Totally worth the cash.
Ghost 4 Linux is crap for this purpose. I've used it many time to clone things, but it is an offline clone tool. Plus if you are going to use G4U's crappy interface, you might as well boot with Knoppix and just use dd.
Symantec's System Restore takes live hot snapshots and can restore an entire PC in an hour or so. It can restore individual files or the whole machine. You can even build a custom restore disk that pulls in all of your obscure drivers.
I keep thinking dd the disk. XP without crap is about 1.5G. A DVD is about 4.7G. Of course, that would only work if you limit Windows to about 4.7G, but why else would you have it unless you wanted to play games? The rest of your disk is partitioned for Linux or data storage, right?
http://www.drivesnapshot.de/en/
Works great, you can restore snapshots from inside Bart PE. Simple to use.
You shouldn't be looking for a freeware system snapshot, you should be looking to use something like SVS mentioned above. It's a absolute delight to be able to have this kind of control in a operating system (kicks a package managers ass! *ducks*). It's not just application virtualisation: A compelling trick you can do with SVS is to back up your SVS installation and all it's data layers (and a few registry settings) you can then completely wipe your Windows installation back to a baseline image and all you need to do is put back registry settings and if you've done a complete format you'll need to copy back your hidden \fsldr folder and the Altiris application.
You can put your virtualised data on a seperate partition or hard drive even.
It also beats DRM (securerom foiled!) and activation features in software and games. Time trial software can be defeated too, you simply reset the data layer to the way it was when the app or game was installed. If you move PCs you don't need to re-activate the application you can just export it and import it.
It pisses me off that OSes don't work this way right from day one (Linux gets it's right somewhat - it doesn't need this in the way Windows so desperatly does).
This solves the problems with Windows becoming bogged down over time. This has made XP and Vista (only works in 32bit) [almost heh] pain free for me.
SVS doesn't work for OS updates or applications that like to install their own drivers or other low-level system changes that require a reboot - although on occasion I've got this working (ie. VMWare Workstation).
After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
Bitter much?
Consider that when you think about the additional cost of a MAC or the learning curve of Linux....
I seriously doubt that keeping Windows working is the point of this little exercise. For starters, that wouldn't require any sort of confidentiality. Second, Windows is pretty stable to begin with, unless you're experimenting with malware, which would be a good reason for doing what he wants to do.
Gnome Partition Editor has a live image one can boot from and backup/resize partitions. I have used it several times on windows systems without any issues.
http://gparted.sourceforge.net/
Boot to Linux Live CD. Find out your hardware isn't supported
Or spend 30 seconds reading install guide for distos to select correct software before downloading the ISO and install linux in 20 minutes!
* go to www.sysresccd.org
* download the latest bootable ISO
* run partimage
* bob's your auntie's live in lover
seriously, this thing rocks. it's fast, can compress disk images, can write disk images over the network, and is totally open source.
CloneZille
Boot from Live CD or Network and Image away!
Drive Snapshot http://www.drivesnapshot.de/en/ It's not freeware, but it works great and it has a differential snapshot function. You should be able to create a snapshot of your master install. Install the next software package. Make a differential snapshot. Shake and repeat. When you're done, you'll be able to mount the different snapshots using Drive Snapshot's Viewer and make comparisons between the installs, etc. Have fun!
No kidding. The story seems a bit too much like "do my job for me". It says it's just a "personal research project" but if it really were personal, then there wouldn't be "confidentiality requirements". Maybe this guy's a RIAA/MPAA stooge and wants to more efficiently look for P2P software or something.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
I suggest you download VirtualBox (it's free!) from Sun, and install XP within a virtual machine. VirtualBox will let you take snapshots of that machine at various points.
If you have to do this with a real physical machine, then instead, use full sector-based imaging product like StorageCraft's ShadowProtect, Acronis' True Image, Symantec's Ghost (aka Backup Exec System Recovery), Paragon Drive Backup, etc. I prefer ShadowProtect because it's the fastest and in my tests it's also the most reliable.
If it is acceptable to you that you don't do the comparison of the before/after state by comparing the disk images, you could use any of the many disk image tools that have already been mentioned to make the disk images, and use PC Magazine's InCtrl5 utility (http://www.pcmag.com/article2/0,2817,25475,00.asp) to generate the report of what changed during an installation.
From reading your request, it seem that InCtrl5 will give you a report of all the changes you are asking about. It just goes about it differently than the way you are asking. Read their description of InCtrl5 and see for yourself whether it gives you what you want. The source is included, so you can study the code to see exactly what it is doing, should you want to check into it in detail. It is NOT open source, though, so if your plan is to make something you can distribute, using InCtrl5 probably isn't suitable for that. I don't know whether the source included is enough for you to make modifications and rebuild purely for your own use. (I think their license doesn't permit even that, but I doubt they would make a fuss about that, even if they could tell you did so.)
It might not be the answer you are looking for, but it seems to me it is worth your time to take a few minutes to check into it.
Its not free but there are technologies that capture all the file io and registry io that an application installation performs (or while the application is running for that matter) into a layer that can be turned on and off at will. Essentially doing what you want to do on separate drives, but instead on a single file system. Altiris has this (now called Symantec Juice) and I believe Microsoft has it as well. Good luck..
http://www.runtime.org/peb.htm
or dd & diff?
DriveImageXML ? Should be relatively easy to compare differences just going through the xml index.
http://www.faronics.com/html/Deepfreeze.asp
/* oops I accidentally made a comment, sorry */
I know one of the developers for the original of Ghost and not even he will use Ghost anymore. He now uses, and recommends, imaging software from Acronis (www.acronis.com). Of course, this is not free, but it's great software.
It's good. It has a 30 day trial. It's not that expensive. It's fast.
http://www.drivesnapshot.de/en/index.htm
and...
you can use windiff to compare snapshots.
I seriously doubt that keeping Windows working is the point of this little exercise. For starters, that wouldn't require any sort of confidentiality. Second, Windows is pretty stable to begin with, unless you're experimenting with malware, which would be a good reason for doing what he wants to do.
You must be knew here, having Windows is a good reason for confidentiality.
Well, Check the whole C:\ into Subversion. Commit the changes after each software install.
Problem solved :-)
Windows Services for UNIX 3.5:
http://technet.microsoft.com/en-us/interopmigration/bb380242.aspx
http://technet.microsoft.com/en-us/magazine/cc160802.aspx
Utilities
SFU comes with more than 300 UNIX utilities as part of the Interix subsystem, with additional utilities available either from InteropSystems or by compiling from available source code. These utilities cover all the major UNIX utilities and areasâ"everything from addr to yaccâ"and behave exactly as you and your UNIX users would expect them to behave.
The utilities include familiar text processing tools, including grep, less, awk, sed, pr, and tr, batch processing tools such as at, cron, and batch, as well as job control tools like ps, nice, kill, and so on. They're all there and they work exactly as you would expect. Even the man command is just as ugly (but infinitely useful) as it's always been.
Utilities such as ps and kill work against both Interix and Win32 processes, making SFU particularly appealing for the system administrator. Need to find and kill all instances of a particular process? The script to do it in Interix is straightforward, whether the process is running in the Win32 subsystem or the Interix subsystem.
As a simplistic but useful example, suppose you have an unknown number of copies of a process running on a machine with SFU. Figure 2 shows a script that will kill them. This script would work exactly the same running on a UNIX or Linux system.
Free Grep and Tail tools for Windows:
http://blogs.officezealot.com/marc/archive/2004/01/31/2046.aspx
Real Digital Forensics:
http://www.jonesdykstra.com/index.php/real-digital-forensics-mainmenu-54
Forensic Discovery:
Wietse Venema:
http://www.porcupine.org/forensics/
Forensic Discovery (he posts it for free, but worth buying)
http://www.porcupine.org/forensics/forensic-discovery/
ftp://ftp.porcupine.org/pub/security/index.html
Dan Farmer:
http://www.fish2.com/security/
~hylas
Installrite
Installwatch
these 2 progs should still be around, just use them to watch the changes that happen during install of an app, then you can create either a package or just a list of changes.
Then use either FOG Project or a partimage distro to make your whole HD image.
This is the poormans equivelant of WISE Packaging Tools.
Clonezilla is rather good at what it does.
It also only backs up the FILES on an NTFS partition (Like ghost) so you don't have huge images containing mostly free space.
http://clonezilla.org/
Clonezilla ..or use a virutal machine like VirtualBox as previously mentioned.
Both are free. I use both myself.
SelfImage 1.2.1.92
SelfImage is a disk imaging program for Windows. It's capable of making an image file of any hard disk or partition on your system. It can even make images of partitions that Windows doesn't recognize or assign a drive letter to (ie: Linux partitions). Perfect for the dual-boot system.
http://fileforum.betanews.com/detail/SelfImage/1134441375/1
DiskTools ImageMaker 1.1
DiskTools ImageMaker is a lightweight disk backup software. It enables you to make exact images of your entire hard drive, or separate partitions on a hard drive, to disk files. The images then may be restored to the initial or any other hard drive or volume, regardless of a file system it is formatted in.
http://fileforum.betanews.com/detail/DiskTools_ImageMaker/1055944044/1
DriveImage XML 2.01
# Backup logical drives and partitions to image files
# Browse these images, view and extract files
# Restore these images to the same or a different drive
# Copy directly from drive to drive
# Schedule automatic backups with your Task Scheduler
Image creation uses Microsoft's Volume Shadow Services (VSS), allowing you to create safe "hot images" even from drives currently in use.
Images are stored in XML files, allowing you to process them with 3rd party tools.
http://www.runtime.org/driveimage-xml.htm\
ODIN 0.11 Beta
ODIN is a utility for easy backup of hard drive volumes or complete hard drives under Windows. A disk image can be created or restored. Only used clusters can be backuped, compression on the fly is possible.
http://odin-win.sourceforge.net/
You can use Perl or Python to write a simple script that logs the entire hard disk, including hidden and system files. You can pull version and size info, among other things.
Save the results in a text file, you can easily do the same with the registry in windows...
Then install whatever, then run the same program again...then a quick compare of the files will reveal EXACTLY what changed on the system.
NO COST, just a little time (very little...both languages will do it in about 10 lines of code.)
Bill, is that you?!
I know there is at least one port.
I found it about 2 years ago, but don't have the link right now. (Google is your friend.)
Or am I missing something ?
ISOdx does that! http://isodxsolutions.com/
Where filename.ext is the file name and
/i means "ignore case". omit this is want case-sensitivity grepping for:
"searchstring"
http://www.clonezilla.org/ basically you must download the ISO LiveCD, burn it to a CD, boot from it, and make an image to another drive, usb, ssh server, nfs, etc. also the resulting image can be compressed. I've just imaged a 40GB partition with 22.5GB used to a 5.12GB archive bzip2 compressed, it took 90mins aprox.
InCtrl5, Version 1.0
Copyright (c) 2000 Ziff Davis Media, Inc.
Written by Neil J. Rubenking
First Published in PC Magazine, US Edition, December 5, 2000, v19n21
http://www.pcmag.com/utilities/
I got this in 2000 and it works well with WinXP. I haven't looked at the website in years. It was freeware then. I wonder if one of my old reports will show up in this horrible travesty, nay, crime against humanity, of a website? Ah, well, I'll just mangle the plain but functional report into plain text:
No. Shocking! The lameness filter!
p.s. A captcha like 'breakup' is why your lame board is spammed like a Hawaiian wedding by losers like me.
Use VMware. It has a snapshot feature that takes a snapshot of a VM, and then records the changes to the VM. I use it when I test an installer; I roll back the snapshot when I'm complete. (Disclaimer: I work for VMware)
No, I will not work for your startup
you could probably easilly setup a svn or bzr local repository with little to no effort.
1 - Install windows /windows and /program files as bzr branches (bzr init; bzr add; bzr commit -m "start fresh". RTFM)
2 - install bzr, setup
3 - install app
4 - commit
5 - repeat 3-4 untill you run out of apps