Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.

VMware ThinApp is the closest thing I can find to this as it shows what was modified between the 2 images as it is trying to create a Virtualized Application. I am not interested in making an virtualized application, I have been using the power of the application to determine other items but would like to know if there are better programs and tools for this type of work.

I do know that some virus can detect being ran inside a VM and will not execute.

share|improve this question
1  
You could try a malware sandbox like cuckoo. –  Zzz Jul 23 '12 at 13:15
    
--Thanks All, this has given me some other ideas. –  brink668 Jul 24 '12 at 22:39

3 Answers 3

Just a quick hint, you can always use a hardware machine and make a binary copy of the hard drive. both Both copies will need to be compared. You can do this by running a checksum. Just be sure nothing is run from the hard drive.

I think backtrack has a nice toolset to do such analysis. You can find them under digital forensics.

share|improve this answer

Try using the applications listed on this page

http://www.raymond.cc/blog/tracking-registry-and-files-changes-when-installing-software-in-windows/

Install the software and take snapshots before infecting the machine.

After the machine is infected, take another snapshot for comparison with the original.

I have found InstallWatchPro to be useful in my investigations.

share|improve this answer

If you are using Unix you could use http://en.wikipedia.org/wiki/Open_Source_Tripwire

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.