Slashdot Mirror
Good Freeware System Snapshot Tool For Windows?
Khyber writes "I'm doing a little personal research into a project that tracks what changes get made to your system every time you install a program. I know there are ways of checking through Windows Restore Points, but that's not what I'm trying to do. Instead, I'm going to start with an absolutely fresh Windows XP install, take a full snapshot of the entire installation on the hard drive, and burn that to a DVD (somewhat like a backup disc with an entire snapshot of my hard drive's current contents.) With every program I install, I'm going to take another snapshot, burn to DVD, and repeat the process until I have recreated every step taken to get to my current system state (all programs installed on a separate hard drive, all registry entries etc on the OS drive, with only snapshots of the OS drive being recorded.) The purpose for all of this I'm not legally allowed to talk about, due to confidentiality requirements. Does anybody know of such a program, preferably freeware, that will accomplish my objective, and are there tools that can be used to compare the difference in drive images?"
Wow, quiet in here.
FOG, aka Free Open Ghosting, at www.fogproject.org, will certainly take images of your hard drives; that's not a problem.
And, I haven't played with it, but it has the capability to do install packages, so that meets the bit-by-bit portion of things.
Like most open-source packages, FOG improves constantly, and recently, it's getting better by leaps and bounds.
stored on computers from birth to the grave
Depending on how long you need to keep the backup, Acronis makes some great imaging utilities with free trials
I have the heart of a child. I keep it in a jar
...but then I'd have to kill you. You know, confidentiality agreements and whatnot...
The best tool I have ever used is Prism Deploy.
It isn't free, but they do have a free trial. I've tried a number of programs to package executable programs and manage Windows images, but nothing has come close.
I'm really interested to see if there are any freeware programs that come close.
If all you need is an indication of what files
have changed, then just use rsync --only-write-batch=FILE
http://samba.anu.edu.au/ftp/rsync/rsync.html
If you need more detailed descriptions (especially for registry changes) you may want to export the registry files in a pre-script, then diff the registry entries.
The easiest way is to run dual boot Fedora/XP. It will take you all of a couple of hours to install Fedora/Ubuntu/Whatever from a Live CD, partitioning the drive as required during the install. You can then backup the whole Win partition without Windows locking any files and what-not. Another approach is to add in another disk for that purpose, maybe a USB thumbdrive if your OS can boot from it.
The other approach is to use a VM machine. There are some cut-down versions of XP designed to work well in them.
WinINSTALL LE
Download
More
Instead of just making a copy after each install, make your copy after you install a program, then copy the original "clean" image back to the drive. Otherwise, you'll never know if a second program would have installed some files that the first program already installed.
knoppix + dd
Sounds like a virtual environment is exactly what you need.
Personally, I use Ghost for imaging and if I want to find out what a program is doing, I run sysinternals File Monitor and Registry Monitor. They're real-time and don't record in a nice format but nothing really beats them on Windows. They've helped me diagnose hundreds of horrible modern and ancient installation programs used in an educational environment to allow network installation (why, exactly, do you need write access to C:\WINDOWS to run a Shockwave-based game for toddlers, etc.?).
Linux/Unix has this much easier because it allows you to monitor EVERYTHING without massive binary blobs having settings stored in them, having settings locked to particular machines, etc. or things generally getting in your way. Windows, it's a pain in the proverbial.
Even a lot of the professional MSI-Builders with their "discovery" modes are absolutely useless at working out what was actually a vital change and what was just the installer playing about, or the user changing their screensaver / explorer view preferences while they installed etc. I spend half my life cleaning MSI's of unnecessary cruft and inserting the entries that they miss. About 50% of automated install captures like this are useless for deployment to a different machine.
Basically, despite the "secrecy" around your particular purpose (why did you have to mention that at all... it makes no difference to what you want and adds nothing to our knowledge), it's probably not worth the hassle. Before and after snapshots, or package the programs and MSI's and you'll find out everything you need along the way, with an actual, practical result at the end. Trying to diff a filesystem/registry image in any way is madness and is only useful if you can get a *perfectly* clean machine, a VERY good automated program to do it brilliantly, where you'll end up with a lot of cruft that isn't related to the program installation at all (e.g. event log entries, temporary files, taskbar icons saving their settings etc.).
Do the install in a virtual machine like VirtualBox or similar. Then you can do as many snapshots you like directly.
c++;
Well, I havn't read the article, but just hit prt-scr! Although, some computers require you too hit function+prt scr. Of course, linux and OSX have better screen shot tools built in. Linux also has GIMP, which does shots! Yup, clearly the answer is 'switch to linux'!
... *sigh*
Seriously, do we even need an article on this?
... I wonder how important the article is after all, but I'm too lazy to read it
Quartz Extreme and Core Image. Are there any other real reasons to spend all that money on generic hardware?
I would recommend regshot at sourceforge. GPL'd.
1. Install program on Windows 2. Boot to linux live cd of your choice 3. cat inputdevice > outputdevice 4. Repeat steps 1-3 as needed 5. diff 6. ????? 7. NDA'd
You might of course just use any hard drive imaging tool, but this is rather slow and clumsy, and it will use a lot of disk space (which isn't necessarily a problem if you really wanna burn a DVD every time). It might be easier and quicker to use one that supports incremental backups. I like Acronis True Image a lot but it is not free.
If you mainly want to document changes done to a running system over time, virtualisation products might fit your purposes well. Most of them have some sort of ability to make snapshots. The popular free VMware Server only allows a single snapshot, but Sun's xVM is every bit as good and does multiple snapshots easily.
I was looking into taking a snapshot of a fresh+patched windows install because I was tired of reformatting and then spending hours reinstalling+patching.
I checked out http://www.partimage.org/ which seems to be the tool targeting what you're trying to do.
For me, it didn't work out because the only apparent way to burn an image to disc is to have DVD+RW media and I didn't have the patience to wait until I could get to the store to buy the rewritables.
There is very little future in being right when your boss is wrong.
Just use DD it's easy
http://www.ss64.com/bash/dd.html
Get a Linux live CD and an external USB drive. Use rsync on the virgin installation and then you can use rsync to only archive the changes from that point on. If you are really stuck on having DVDs at the end of this, you can then merge the two rsyncs (the original with the changes) and burn that to disk.
What you're aiming to do is perfectly valid but the method you describe in order to achieve your goal is horribly inefficient; I'd be hard pushed to think of a more time-consuming and difficult way to achieve your goal. My tip:
This sounds like an absolutely ideal scenario where you could benefit from virtualisation technology. Install the system you wish to "monitor" in a virtual machine. I come from the VMware world, and I can say that the snapshots feature of VMware Workstation would do exactly what it sounds like you want. Whenever you wish to capture an image of the present state of the machine, take a snapshot. Further, you can take as many snapshots as you please, these snapshots can be built on previous snapshots, and you can even have branching snapshots. Icing on the cake: only the differences since the last snapshot will be saved, so you'll save a huge amount of data versus burning complete snapshots to DVD.
What next? Simple, mount the snapshots as a drive on the host machine and diff them using the tool of your choice. I use WinDiff for basic directory/file comparison, but there's a multitude of options out there. The only problem I can imagine would be you probably can't mount multiple snapshots simultaneously from the same virtual disk, but you could get around this by just making a copy of the VHD on your HD and mounting the second snapshot off that.
By the way, there's likely other virtualisation products out there (e.g. VirtualBox) that can achieve what I described above, I'm purely using VMware Workstation as an example as it's my virtualiser of choice. Further, VMware Workstation is not free, VBox is.
Just boot from a liveCD, then clone the drive?
That would make sure that your clone is consistent, and since you cannot continue working with the pc while the cloning is in progress (that would certainly make it inconsistent), there is not much disadvantage in rebooting.
If you want to get fancy, install a second OS, and make a script that upon booting that OS automatically clones the first OS and then reboots. Any linux can do this easily.
Since you also have a second drive, the burning to dvd can happen later.
It is called the Shadow Copy. It will give you snapshots of the drive state periodically and all the changes (this is not Restore Points). More info can be found here...
http://sansforensics.wordpress.com/2008/10/10/shadow-forensics/
i Use http://www.clonezilla.org/ to backup the HD. nomaly i only backup the patision were the system is on, a 100GB HD i take 20 GB for the backup then it don't take me 3-10h to install windows + programmers + setup then it only take 10 mins. to get back on and the children can play agen. fist time i say to my border nothing can go rung it took him 10 mins to fuck windows up :) he was 6 at that time
Shockwave installs system files for it to run
C:\WINDOWS\system32\Adobe\Shockwave 11
the game may of needed to install a Xtra for Shockwave
C:\WINDOWS\system32\Adobe\Shockwave 11\Xtras
Try cygin + dd.
Is free for personal use, makes images, creates a boot cd for recovery. very slick program.
*tap tap tap* this thing on?
Check out the Microsoft Business Desktop Deployment software. Free and pretty easy to setup and use.
Is there a reason why sysprep wouldn't work? It's already on your system I would wager.
XML is like violence. If it doesn't solve the problem, use more.
Try http://www.feyrer.de/g4u/ It does full drive imaging at block level, and is free. It gzips the image, but you can unzip them and do a binary compare against them. Though storing complete drive images like this is going to be awfully painful, especially if you plan to burn them off to DVD.. As for the compare, there are a few free tools around there.
There's a tool called Ghost 4 Linux that might do what you need. You boot with the g4l disk on your backup target. You can then specify a remote server or a local storage device to create the image backup. It doesn't matter what OS is being stored as it's a physical image.
Files can be very large because it copies sectors, not files, so even deleted files can take space. To minimize this there are some disk zero utilities that will zero out the unused space on your drive.
I use it often for backing up my Windows laptops.
From what i can understand what you really want to do is compare the differences between the installations of different apps? If thats the case any old MSI packaging solution will do the trick much better and with much greater detail. They almost all have a very handy function for tracking every single thing an application does on your computer. Some, like Emcos, are very easy to use and have a very clear and consistend interface for displaying the changes made. I assume youre not after what Windows XP does but rather what installations does.
For example, buy Emco Package Manager, install it on your pristine XP install. Start Emco and put it in recording mode. Do an installation / alteration / run your evil application of choice and stop the recording. Then you have all the alterations on screen easily readable.
HTTP/1.1 400
My weapon of choice is Acronis TrueImage. Allows for complete drive imaging over a network, etc. They offer BartPE files so you can make a boot disc, though.
I use the boot CD all the time for rescue and recovery.
I would try something on download.com or just try a good google search. Seems like an interesting project. Good luck. -Steve
-Steve "The Geek" Hencye
I don't have any free tools to recommend. With that in mind...
1. Many of VMWare's commercial tools have built in capabilities for storing multiple revisions of a computer configuration in as little space as possible - each different install can be a change set keyed off a previous install. Of course, you have to stick to virtual machines for this to work.
2. For my day to day personal Windows hardware I use DriveSnapshot ( http://www.drivesnapshot.de/en/home.htm ). It can perform image backups of the running system (even the boot disk). In addition, it gives you the ability to perform Differential backups which store only the changes from the root backup. It also is able to reduce IO on the differential backup by a) only reading allocated space on the source drive and b) storing a hash file for each root backup so that you don't need to perform as much IO on the backup target volume.
You can download a 30-day-ish trial for free. After 30 days, you can still restore from those backups, but if you want to continue to back up, you need to buy it.
It has some super sneaky hackerish administrator-friendly capabilities. e.g. the same executable runs in both windows as a GUI and DOS (even a DOS floppy) as a command line, you can create network boot disks for network restores from a samba share, etc.
And lastly, the author (Tom) is good at responding to email.
-brendan
Two areas immediately spring to mind:
- the registry is probably the most important object you want to monitor, so you'll need to somehow export the registry into a diff-able format.
- windows also uses "structured storage" (basically a filesystem in a file) for a lot of things -- you'll also need to be able to export those somehow?
Either use VMWare or a tool called Process Explorer / Process Monitor. These will do what you need.
If only Windows ran on ZFS :(
Us Solaris peeps do *exactly* this. Take a snapshot immediately after install, take another snapshot after configuring the system, take any additional snapshots later...
I would post an output from zfs list showing all the snapshots taken on the root filesystem, but unfortunately slashdot's lameness filter REFUSES to cooperate telling me to use fewer junk characters :(
FreeBSD http://wiki.freebsd.org/ZFS and MacOSX http://www.apple.com/macosx/snowleopard/ will soon have proper ZFS with boot support.... and Linux's ZFS-Fuse Implementation is great. Hell, it won't be long before Windows will be the only (worthwhile) OS that will be without ZFS soon.... maybe Microsoft should abandon WinFS (oh yeah, they did) and just port ZFS over.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
1. Download Linux Live CD (700mb).
2. Boot to Linux Live CD. Find out your hardware isn't supported as MoBo is new.
3. Download different Live CD.
4. Repeat 2 and 3.
5. Find Live CD which allows you to boot X. You're not a console monkey, so you need a GUI.
6a. Wireless network doesn't work "out of the box." Find / make 30m patch lead to go from back of PC downstairs to your router. Download NDISWrapper and firmware. Configure wireless networking. Alternatively;
6b. Look online for help using dd and sdiff, as you've never, ever heard of these applications.
7. Read three different forums full of "OMG go bk 2 winbl0wz, n00b!11" posts regarding the same issue until you find one person who has managed to pry the information you need out of somebody with a small sense of community.
8. Take image of Windows partition. Make coffee while you wait.
Total time to complete, with downloading images: 9 hours 40 minutes.
Total time to reinstall Windows XP, patch, and install games: 5 hours.
THAT'S how tough it is. We're not all Linux users.
Finally had enough. Come see us over at https://soylentnews.org/
Mod parent -1 Sadist.
Finally had enough. Come see us over at https://soylentnews.org/
Have you tried the free partition imaging tool from Microsoft, WDS? Build a server with DHCP, install WDS and configure PXE boot. Then, after each step, you can boot off the network and create a WIM file. The nice thing is you can mount the WIm files on "mount points" which appear as folders. This is very handy as you can then do deep analysis of the files at a bit level. You could literally compare two folders and all contents and tag only the files that have changed. of note: WDS and ImageX only capture the files. If you are doing rootkit or virus research, some of these may do some funky stuff with the file system which may not be picked up by ImageX. But Otherwise; this is a free solution with the added benefit of using the same tool (imagex) to allow you to "mount" a WIM file for analysis. HTH! Marble68
/me sips his coffee and ponders a new sig...
They bundled a tiny copy in ADS 1.0(Active Deployment Services or something like that) as imgdeploy, at 512 KB its likely to be the smallest utility you can find for free (as in cost not code) from a commercial software company that can do basically anything ghost can do. It's block based so it should fairly flexible operating system wise. The only difficult thing is downloading the large wrapper that is ADS 1.0 and sifting through it just to get the imgdeploy.exe. The same binary does capture and deploy.
If you have a mini-me operating system like the winpe, bart or something you could wrap a .hta application to give it a smiley interface, otherwise you can figure out how to use it from the cmd prompt usage message. You don't really have to read the docs.
In ADS 1.1 I believe they replaced this with ImageX which is a small utility for creating wimages.. think swim-sandwiches.. and you'll get the pronounciation. Wimages based on the .wim (no I'm not kidding ;-) whimsical isn't it?) are file based and go hand in hand with Vista installations. They might be more to your liking if your thinking incrementals since they are file based.
There is a tar like utility for windows called str or something that is very tiny and does the streaming archive thing.
There are a bazillion answers to this.. but those should get you started.. and don't forget Bacula if you have a fast gig switch.. you probably need to get the images off and on your hard disk fairly fast.
Regsnap from LastBit Software will snapshot the entire registry and system file
lists (if you want it to) and save it out to a file. Once you make your changes
or installations you can snapshot it again and then directly compare the two files
and generate a difference file of all the changes to the system. It's a fairly
useful utility for capturing what installers/applications do to windows based
systems. Unfortunately it's not free.
While that is a better approach, I would argue that the entire concept of using a diff to try to determine what an installer is doing is usually a bad idea.
It can be useful for troubleshooting, but most people (and software vendors) try this kind of thing to build "repackaging" installer-builders. It's a terrible idea.
An installer may do completely different things depending on the system configuration. There is the factor you mention about existing file versions. If the user chooses a different install path/install options, has different OS components or software, etc. etc. that can potentially change things like registry keys or even the data inside binary files.
Unless you're building for an environment that is 100% standardized on a particular model of device, with a consistent OS version/patch level, there's just no point. Use the vendor's own MSI's or other installers in silent mode - that's what they're there for!
Using this type of approach for a pseudo-uninstall is equally dangerous, for similar reasons. Because Windows is such a hack-job for backwards compatibility purposes (which I think is the only option MS has, due to the public's perception that issues with backwards compatibility are their fault rather than the fault of terrible software developers), the only safe way to do this kind of thing that I can think of is what Vista does with its Windows-on-Windows (ew!) file and registry virtualization. It's a huge space hog, it's a waste of RAM (IMO), but it works.
"...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
So you say "ZFS-Fuse is great".
You're the first person i've heard say that; everywhere else i see "horribly slow" and similar comments.
I take it you've actually used ZFS under FUSE on linux?
then you have to look at drivesnapshot. Drivesnapshot.de is the website, it isnt "cheap" but not expensive and worth EVERY penny. This plus the software at runtime.org for data recovery and you are set for $200
I have used the freeware installwatch pro software for similar purposes. It is not perfect, but allows you to take a snapshot of all files and reg keys prior to performing 'some' action (browser option change, software install, etc.). After you finish the action, you perform another snapshot and it traps the deltas across filesystem - file add, delete, modify - including .ini changes and also reg key add/del/change activities.... It also stores the deltas by whatever you wish to name the change, for future reference..
Installwatch Pro - http://epsilonsquared.com/
They have another tool, install rite, which I am unfamiliar with...
I think we can agree that the registry is 100% Microsofts' fault :-)
It was one of those design decisions that "sort of" seemed to make sense (if you were drunk enough), but that in retrospect was just plain wrong.
That said, a diff of the entire filesystem between a virgin install and any particular program could be useful, especially when tracking down files modified bye spyware or malware installs.
Sounds to me that you might look into the API of Thinstall. It has to keep track of all changes so that it can run a packager. I have played with a few apps that have been created from it and they seem to work great. I imagine that if the API is good getting to that info and even tweaking it might be possible.
Sera
Slashdot, where armchair scientists get shouted down and armchair theologians get modded up.
I have been using a Windows XP setup based around Faronic's Deep Freeze for the past few months now and my system is, for the most part, "bulletproof". (Believe me... I also cringe whenever anyone uses that phrase unintelligently, but until I see otherwise, this is how I term this setup)
Let me start with a little understanding of what exactly Deep Freeze does... because this is the part that I didn't grasp fully until a few months ago. It can setup a drive, or drives on your system to be what is called "frozen". Frozen meaning any changes done to the system are removed upon next boot.
The altered state of frozen is what is termed appropriately as "Thawed". Thawed meaning any changes done to thawed drives are retained.
My setup is quite simple. I have a 3 drive, 4 partition setup, which is arranged as follows:
The system drive is the only frozen drive, all information that I would need to change on a regular to semi-regular basis is moved onto other drives.
So if all of my files I need are moved onto other drives, and I have a frozen system, barring physical drive failure, almost any software change I do not want to happen, can easily be repaired by rebooting.
Thus the reason I call this my "bulletproof" setup.
Please offer your comments. :)
Taking an initial and progressive snapshots are a good idea to start with and a VM tool will let you do this if you are just monitoring what software is doing. Go with Virtual PC 2007, it is free and will let you take the VHD images and later remount them as secondary drives on a VM to compare them.
However depending on your end goal, it might be better to 'also' just data mine the changes to the system. Use http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx (Process Explorer) as it tracks all the changes, including read/writes to everything on the OS from the File System to the registry specifically.
Process Explorer has been around for a while and is kept updated. It is a valuable tool for tracking what install software is doing on your system, what it is changing and touch and although it can produce huge logs of data, doing a bit of dataming on this data can produce a lot of information about system changes. (It is something crackers even use to see what keys or files are changed to store random information to unlock software, etc.)
On Windows, this is the key tool for monitoring the system all the way down.
So Virtual PC 2007 for VHD images and Process Explorer (always running) storing the data of all the changes.
This should give you everything you need.
How about looking at application virtualization technologies like Altiris's Software Virtualization Solution (SVS)? SVS allows you to capture the install of an application and see the files and registry changes it makes when installing an application. You can then save the application and all of its files and reg entries as a single file. Going further it also captures any changes made while running an application, which is also something you need to consider as some apps make further changes after running the first time. SVS is for enterprises though you can also download and use a personal version with all the same capabilities and features of the enterprise version. I use it for most applications on my home system and it is especially good for trying out new applications since you can simply delete the captured application after your done with it as easily as you delete a file! Once you have all your applications captured this way rebuilding a system is as easy as installing the OS or an image and reimporting the captured application files. Very quick and very easy! Check it out! http://juice.altiris.com/node/86
Not exactly what you were asking for, but once you have imaged the system with whatever tool you choose, you can use SVS to virtualize your software installs. There is a free personal edition, but it is also scalable to a full server deployment where you can create, push out and manage virtualized software packages.
Resources:
http://svsdownloads.com/
http://juice.altiris.com/ev
-lumenistan
I just found out about this yesterday, and I have not tried it myself yet, but apparently, Seagate has an OEM version of TrueImage for use with Seagate hard drives. They call it "Seagate DiscWizard". I really don't know if they've kept the cool live disc image feature or not... I'll find out later today when I try it.
http://ping.windowsdream.com/ Works great!
Live Linux CD + dd + sdiff
How tough was that?
The question is "Livecd + dd + sdiff what?"
It's easy to get a dd image of a running machine this way (and just as easy to do it using virtualisation-solution-of-your-choice, as everyone who isn't saying "just use dd" is saying).
It's slightly less easy to work out which files have been added, which modified, and which deleted , since you last did it. You'll also need to work out which were changes due to the new software that you installed, and which due to stuff that happens anyway. Changes to text files you may be able to work out what they're for by looking at them, but changes to binary files you can't.
You also need to treat the Windows registry as one or more "files", which you can read with dd, but if you want to get any sense out of it you're going to need to dump it to text first and compare those
The really difficult bit is going through the sheer volume of data that you'll create doing this. How do you know that application a requires component c but didn't install it according to your diff because application b had already installed it?
As part of my job I'll occasionally need to test the effect of a bit of new software in slightly different configurations and then retest it in the same configurations to make sure that it still does what it's supposed to do. Something like VMware is great for this (quicker than dd, because you're not booting off a CD every time you want to make a copy). Neither will help you analyze what's changed between image a and image b though.
You shouldn't be looking for a freeware system snapshot, you should be looking to use something like SVS mentioned above. It's a absolute delight to be able to have this kind of control in a operating system (kicks a package managers ass! *ducks*). It's not just application virtualisation: A compelling trick you can do with SVS is to back up your SVS installation and all it's data layers (and a few registry settings) you can then completely wipe your Windows installation back to a baseline image and all you need to do is put back registry settings and if you've done a complete format you'll need to copy back your hidden \fsldr folder and the Altiris application.
You can put your virtualised data on a seperate partition or hard drive even.
It also beats DRM (securerom foiled!) and activation features in software and games. Time trial software can be defeated too, you simply reset the data layer to the way it was when the app or game was installed. If you move PCs you don't need to re-activate the application you can just export it and import it.
It pisses me off that OSes don't work this way right from day one (Linux gets it's right somewhat - it doesn't need this in the way Windows so desperatly does).
This solves the problems with Windows becoming bogged down over time. This has made XP and Vista (only works in 32bit) [almost heh] pain free for me.
SVS doesn't work for OS updates or applications that like to install their own drivers or other low-level system changes that require a reboot - although on occasion I've got this working (ie. VMWare Workstation).
After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
I'm going for +5 Informative: http://en.wikipedia.org/wiki/Diff http://en.wikipedia.org/wiki/Dd_(Unix) At least by doing this you will educate yourself along the way. If you are opposed to self-education, here is another wikipedia entry for you: http://en.wikipedia.org/wiki/Ignorance
Drive Snapshot http://www.drivesnapshot.de/en/ It's not freeware, but it works great and it has a differential snapshot function. You should be able to create a snapshot of your master install. Install the next software package. Make a differential snapshot. Shake and repeat. When you're done, you'll be able to mount the different snapshots using Drive Snapshot's Viewer and make comparisons between the installs, etc. Have fun!
No kidding. The story seems a bit too much like "do my job for me". It says it's just a "personal research project" but if it really were personal, then there wouldn't be "confidentiality requirements". Maybe this guy's a RIAA/MPAA stooge and wants to more efficiently look for P2P software or something.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
If it is acceptable to you that you don't do the comparison of the before/after state by comparing the disk images, you could use any of the many disk image tools that have already been mentioned to make the disk images, and use PC Magazine's InCtrl5 utility (http://www.pcmag.com/article2/0,2817,25475,00.asp) to generate the report of what changed during an installation.
From reading your request, it seem that InCtrl5 will give you a report of all the changes you are asking about. It just goes about it differently than the way you are asking. Read their description of InCtrl5 and see for yourself whether it gives you what you want. The source is included, so you can study the code to see exactly what it is doing, should you want to check into it in detail. It is NOT open source, though, so if your plan is to make something you can distribute, using InCtrl5 probably isn't suitable for that. I don't know whether the source included is enough for you to make modifications and rebuild purely for your own use. (I think their license doesn't permit even that, but I doubt they would make a fuss about that, even if they could tell you did so.)
It might not be the answer you are looking for, but it seems to me it is worth your time to take a few minutes to check into it.
"THAT'S how tough it is. We're not all Linux users."
I'll buy the live CD distro churning (BTDT), but among the reasons I enjoy Linux is that there are plenty of helpful folks who DIDN'T give me the "GTFO newfag" treatment.
It's easy to find newbie forums and lurk before posting, and it was easy back in 1999 when I didn't know shit about computers let alone Linux.
"Total time to complete, with downloading images: 9 hours 40 minutes."
Seems reasonable, since learning new stuff is involved. Once ya are edumacated you have many more options at your disposal.
"Total time to reinstall Windows XP, patch, and install games: 5 hours."
No empowerment or tools for future use that way...
If you prefer Win-centric solutions it's worth spending the time to learn Ghost via the Radified tutorial, how to build and use a live WinPE/BartPE CD to rescue your stuff prior to a nuke-and-pave, how to slipstream your XP install disk, how to have your updates handy on DVD by using the offline update tool, etc, etc. That takes longer than 5 hours too. :)
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
http://www.runtime.org/peb.htm
or dd & diff?
Process Monitor is blocked by the issue I'm encountering.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
http://www.faronics.com/html/Deepfreeze.asp
/* oops I accidentally made a comment, sorry */
I seriously doubt that keeping Windows working is the point of this little exercise. For starters, that wouldn't require any sort of confidentiality. Second, Windows is pretty stable to begin with, unless you're experimenting with malware, which would be a good reason for doing what he wants to do.
You must be knew here, having Windows is a good reason for confidentiality.
Windows Services for UNIX 3.5:
http://technet.microsoft.com/en-us/interopmigration/bb380242.aspx
http://technet.microsoft.com/en-us/magazine/cc160802.aspx
Utilities
SFU comes with more than 300 UNIX utilities as part of the Interix subsystem, with additional utilities available either from InteropSystems or by compiling from available source code. These utilities cover all the major UNIX utilities and areasâ"everything from addr to yaccâ"and behave exactly as you and your UNIX users would expect them to behave.
The utilities include familiar text processing tools, including grep, less, awk, sed, pr, and tr, batch processing tools such as at, cron, and batch, as well as job control tools like ps, nice, kill, and so on. They're all there and they work exactly as you would expect. Even the man command is just as ugly (but infinitely useful) as it's always been.
Utilities such as ps and kill work against both Interix and Win32 processes, making SFU particularly appealing for the system administrator. Need to find and kill all instances of a particular process? The script to do it in Interix is straightforward, whether the process is running in the Win32 subsystem or the Interix subsystem.
As a simplistic but useful example, suppose you have an unknown number of copies of a process running on a machine with SFU. Figure 2 shows a script that will kill them. This script would work exactly the same running on a UNIX or Linux system.
Free Grep and Tail tools for Windows:
http://blogs.officezealot.com/marc/archive/2004/01/31/2046.aspx
Real Digital Forensics:
http://www.jonesdykstra.com/index.php/real-digital-forensics-mainmenu-54
Forensic Discovery:
Wietse Venema:
http://www.porcupine.org/forensics/
Forensic Discovery (he posts it for free, but worth buying)
http://www.porcupine.org/forensics/forensic-discovery/
ftp://ftp.porcupine.org/pub/security/index.html
Dan Farmer:
http://www.fish2.com/security/
~hylas
SelfImage 1.2.1.92
SelfImage is a disk imaging program for Windows. It's capable of making an image file of any hard disk or partition on your system. It can even make images of partitions that Windows doesn't recognize or assign a drive letter to (ie: Linux partitions). Perfect for the dual-boot system.
http://fileforum.betanews.com/detail/SelfImage/1134441375/1
DiskTools ImageMaker 1.1
DiskTools ImageMaker is a lightweight disk backup software. It enables you to make exact images of your entire hard drive, or separate partitions on a hard drive, to disk files. The images then may be restored to the initial or any other hard drive or volume, regardless of a file system it is formatted in.
http://fileforum.betanews.com/detail/DiskTools_ImageMaker/1055944044/1
DriveImage XML 2.01
# Backup logical drives and partitions to image files
# Browse these images, view and extract files
# Restore these images to the same or a different drive
# Copy directly from drive to drive
# Schedule automatic backups with your Task Scheduler
Image creation uses Microsoft's Volume Shadow Services (VSS), allowing you to create safe "hot images" even from drives currently in use.
Images are stored in XML files, allowing you to process them with 3rd party tools.
http://www.runtime.org/driveimage-xml.htm\
ODIN 0.11 Beta
ODIN is a utility for easy backup of hard drive volumes or complete hard drives under Windows. A disk image can be created or restored. Only used clusters can be backuped, compression on the fly is possible.
http://odin-win.sourceforge.net/
Where filename.ext is the file name and
/i means "ignore case". omit this is want case-sensitivity grepping for:
"searchstring"
http://www.clonezilla.org/ basically you must download the ISO LiveCD, burn it to a CD, boot from it, and make an image to another drive, usb, ssh server, nfs, etc. also the resulting image can be compressed. I've just imaged a 40GB partition with 22.5GB used to a 5.12GB archive bzip2 compressed, it took 90mins aprox.
While this is not free as requested by the original askslashdot poster, I would also mention SnAppshot from Novell. It sounds like it will be exactly what he/she is looking for. I've used it in the past to snap an OS, install software or reconfigure something, and then snap again to list all of the registry and file changes. It worked really well and made it possible to script some automation into our task of configuring a large number of workstations.
Use VMware. It has a snapshot feature that takes a snapshot of a VM, and then records the changes to the VM. I use it when I test an installer; I roll back the snapshot when I'm complete. (Disclaimer: I work for VMware)
No, I will not work for your startup
you could probably easilly setup a svn or bzr local repository with little to no effort.
1 - Install windows /windows and /program files as bzr branches (bzr init; bzr add; bzr commit -m "start fresh". RTFM)
2 - install bzr, setup
3 - install app
4 - commit
5 - repeat 3-4 untill you run out of apps