Slashdot Mirror
Good Freeware System Snapshot Tool For Windows?
Khyber writes "I'm doing a little personal research into a project that tracks what changes get made to your system every time you install a program. I know there are ways of checking through Windows Restore Points, but that's not what I'm trying to do. Instead, I'm going to start with an absolutely fresh Windows XP install, take a full snapshot of the entire installation on the hard drive, and burn that to a DVD (somewhat like a backup disc with an entire snapshot of my hard drive's current contents.) With every program I install, I'm going to take another snapshot, burn to DVD, and repeat the process until I have recreated every step taken to get to my current system state (all programs installed on a separate hard drive, all registry entries etc on the OS drive, with only snapshots of the OS drive being recorded.) The purpose for all of this I'm not legally allowed to talk about, due to confidentiality requirements. Does anybody know of such a program, preferably freeware, that will accomplish my objective, and are there tools that can be used to compare the difference in drive images?"
Wow, quiet in here.
FOG, aka Free Open Ghosting, at www.fogproject.org, will certainly take images of your hard drives; that's not a problem.
And, I haven't played with it, but it has the capability to do install packages, so that meets the bit-by-bit portion of things.
Like most open-source packages, FOG improves constantly, and recently, it's getting better by leaps and bounds.
stored on computers from birth to the grave
...but then I'd have to kill you. You know, confidentiality agreements and whatnot...
The best tool I have ever used is Prism Deploy.
It isn't free, but they do have a free trial. I've tried a number of programs to package executable programs and manage Windows images, but nothing has come close.
I'm really interested to see if there are any freeware programs that come close.
If all you need is an indication of what files
have changed, then just use rsync --only-write-batch=FILE
http://samba.anu.edu.au/ftp/rsync/rsync.html
If you need more detailed descriptions (especially for registry changes) you may want to export the registry files in a pre-script, then diff the registry entries.
WinINSTALL LE
Download
More
Instead of just making a copy after each install, make your copy after you install a program, then copy the original "clean" image back to the drive. Otherwise, you'll never know if a second program would have installed some files that the first program already installed.
Sounds like a virtual environment is exactly what you need.
Personally, I use Ghost for imaging and if I want to find out what a program is doing, I run sysinternals File Monitor and Registry Monitor. They're real-time and don't record in a nice format but nothing really beats them on Windows. They've helped me diagnose hundreds of horrible modern and ancient installation programs used in an educational environment to allow network installation (why, exactly, do you need write access to C:\WINDOWS to run a Shockwave-based game for toddlers, etc.?).
Linux/Unix has this much easier because it allows you to monitor EVERYTHING without massive binary blobs having settings stored in them, having settings locked to particular machines, etc. or things generally getting in your way. Windows, it's a pain in the proverbial.
Even a lot of the professional MSI-Builders with their "discovery" modes are absolutely useless at working out what was actually a vital change and what was just the installer playing about, or the user changing their screensaver / explorer view preferences while they installed etc. I spend half my life cleaning MSI's of unnecessary cruft and inserting the entries that they miss. About 50% of automated install captures like this are useless for deployment to a different machine.
Basically, despite the "secrecy" around your particular purpose (why did you have to mention that at all... it makes no difference to what you want and adds nothing to our knowledge), it's probably not worth the hassle. Before and after snapshots, or package the programs and MSI's and you'll find out everything you need along the way, with an actual, practical result at the end. Trying to diff a filesystem/registry image in any way is madness and is only useful if you can get a *perfectly* clean machine, a VERY good automated program to do it brilliantly, where you'll end up with a lot of cruft that isn't related to the program installation at all (e.g. event log entries, temporary files, taskbar icons saving their settings etc.).
Do the install in a virtual machine like VirtualBox or similar. Then you can do as many snapshots you like directly.
c++;
Well, I havn't read the article, but just hit prt-scr! Although, some computers require you too hit function+prt scr. Of course, linux and OSX have better screen shot tools built in. Linux also has GIMP, which does shots! Yup, clearly the answer is 'switch to linux'!
... *sigh*
Seriously, do we even need an article on this?
... I wonder how important the article is after all, but I'm too lazy to read it
Quartz Extreme and Core Image. Are there any other real reasons to spend all that money on generic hardware?
I would recommend regshot at sourceforge. GPL'd.
1. Install program on Windows 2. Boot to linux live cd of your choice 3. cat inputdevice > outputdevice 4. Repeat steps 1-3 as needed 5. diff 6. ????? 7. NDA'd
You might of course just use any hard drive imaging tool, but this is rather slow and clumsy, and it will use a lot of disk space (which isn't necessarily a problem if you really wanna burn a DVD every time). It might be easier and quicker to use one that supports incremental backups. I like Acronis True Image a lot but it is not free.
If you mainly want to document changes done to a running system over time, virtualisation products might fit your purposes well. Most of them have some sort of ability to make snapshots. The popular free VMware Server only allows a single snapshot, but Sun's xVM is every bit as good and does multiple snapshots easily.
I was looking into taking a snapshot of a fresh+patched windows install because I was tired of reformatting and then spending hours reinstalling+patching.
I checked out http://www.partimage.org/ which seems to be the tool targeting what you're trying to do.
For me, it didn't work out because the only apparent way to burn an image to disc is to have DVD+RW media and I didn't have the patience to wait until I could get to the store to buy the rewritables.
There is very little future in being right when your boss is wrong.
What you're aiming to do is perfectly valid but the method you describe in order to achieve your goal is horribly inefficient; I'd be hard pushed to think of a more time-consuming and difficult way to achieve your goal. My tip:
This sounds like an absolutely ideal scenario where you could benefit from virtualisation technology. Install the system you wish to "monitor" in a virtual machine. I come from the VMware world, and I can say that the snapshots feature of VMware Workstation would do exactly what it sounds like you want. Whenever you wish to capture an image of the present state of the machine, take a snapshot. Further, you can take as many snapshots as you please, these snapshots can be built on previous snapshots, and you can even have branching snapshots. Icing on the cake: only the differences since the last snapshot will be saved, so you'll save a huge amount of data versus burning complete snapshots to DVD.
What next? Simple, mount the snapshots as a drive on the host machine and diff them using the tool of your choice. I use WinDiff for basic directory/file comparison, but there's a multitude of options out there. The only problem I can imagine would be you probably can't mount multiple snapshots simultaneously from the same virtual disk, but you could get around this by just making a copy of the VHD on your HD and mounting the second snapshot off that.
By the way, there's likely other virtualisation products out there (e.g. VirtualBox) that can achieve what I described above, I'm purely using VMware Workstation as an example as it's my virtualiser of choice. Further, VMware Workstation is not free, VBox is.
i Use http://www.clonezilla.org/ to backup the HD. nomaly i only backup the patision were the system is on, a 100GB HD i take 20 GB for the backup then it don't take me 3-10h to install windows + programmers + setup then it only take 10 mins. to get back on and the children can play agen. fist time i say to my border nothing can go rung it took him 10 mins to fuck windows up :) he was 6 at that time
There's a tool called Ghost 4 Linux that might do what you need. You boot with the g4l disk on your backup target. You can then specify a remote server or a local storage device to create the image backup. It doesn't matter what OS is being stored as it's a physical image.
Files can be very large because it copies sectors, not files, so even deleted files can take space. To minimize this there are some disk zero utilities that will zero out the unused space on your drive.
I use it often for backing up my Windows laptops.
1. Download Linux Live CD (700mb).
2. Boot to Linux Live CD. Find out your hardware isn't supported as MoBo is new.
3. Download different Live CD.
4. Repeat 2 and 3.
5. Find Live CD which allows you to boot X. You're not a console monkey, so you need a GUI.
6a. Wireless network doesn't work "out of the box." Find / make 30m patch lead to go from back of PC downstairs to your router. Download NDISWrapper and firmware. Configure wireless networking. Alternatively;
6b. Look online for help using dd and sdiff, as you've never, ever heard of these applications.
7. Read three different forums full of "OMG go bk 2 winbl0wz, n00b!11" posts regarding the same issue until you find one person who has managed to pry the information you need out of somebody with a small sense of community.
8. Take image of Windows partition. Make coffee while you wait.
Total time to complete, with downloading images: 9 hours 40 minutes.
Total time to reinstall Windows XP, patch, and install games: 5 hours.
THAT'S how tough it is. We're not all Linux users.
Finally had enough. Come see us over at https://soylentnews.org/
Mod parent -1 Sadist.
Finally had enough. Come see us over at https://soylentnews.org/
Regsnap from LastBit Software will snapshot the entire registry and system file
lists (if you want it to) and save it out to a file. Once you make your changes
or installations you can snapshot it again and then directly compare the two files
and generate a difference file of all the changes to the system. It's a fairly
useful utility for capturing what installers/applications do to windows based
systems. Unfortunately it's not free.
Live Linux CD + dd + sdiff
How tough was that?
The question is "Livecd + dd + sdiff what?"
It's easy to get a dd image of a running machine this way (and just as easy to do it using virtualisation-solution-of-your-choice, as everyone who isn't saying "just use dd" is saying).
It's slightly less easy to work out which files have been added, which modified, and which deleted , since you last did it. You'll also need to work out which were changes due to the new software that you installed, and which due to stuff that happens anyway. Changes to text files you may be able to work out what they're for by looking at them, but changes to binary files you can't.
You also need to treat the Windows registry as one or more "files", which you can read with dd, but if you want to get any sense out of it you're going to need to dump it to text first and compare those
The really difficult bit is going through the sheer volume of data that you'll create doing this. How do you know that application a requires component c but didn't install it according to your diff because application b had already installed it?
As part of my job I'll occasionally need to test the effect of a bit of new software in slightly different configurations and then retest it in the same configurations to make sure that it still does what it's supposed to do. Something like VMware is great for this (quicker than dd, because you're not booting off a CD every time you want to make a copy). Neither will help you analyze what's changed between image a and image b though.
I'm going for +5 Informative: http://en.wikipedia.org/wiki/Diff http://en.wikipedia.org/wiki/Dd_(Unix) At least by doing this you will educate yourself along the way. If you are opposed to self-education, here is another wikipedia entry for you: http://en.wikipedia.org/wiki/Ignorance
No kidding. The story seems a bit too much like "do my job for me". It says it's just a "personal research project" but if it really were personal, then there wouldn't be "confidentiality requirements". Maybe this guy's a RIAA/MPAA stooge and wants to more efficiently look for P2P software or something.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.