Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically analyze a software for the files which software deals with. is there any software available to do this? Am using Windows machine.

share|improve this question
up vote 5 down vote accepted

I'd suggest that you could use Process Monitor from the sysinternals suite to do this.

share|improve this answer

I'd recommend using a FIM (File Integrity Monitoring) tool. This will let you take a snapshot of your system before you make changes, and then another snapshot after you make changes - then you can to see what files and registry entries have changed inbetween snapshots.

OSSEC is an Open Source system that can monitor files for changes. I'm not sure if it can monitor registry keys, or just files. It's certainly not the easiest to configure and use, but it is free, and works on Windows and Linux.

Ionx Verisys is a commercial file integrity monitoring system for Windows that has the advantage of having a central GUI for configuration, reporting etc - so it's a lot easier to setup and operate than OSSEC. This one definately monitors both files and registry entries.

share|improve this answer
I can confirm that OSSEC does monitor registry changes as part of file integrity monitoring as well. ;) – TildalWave May 28 '13 at 13:06

You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes.

You could run 2 separate systems; one running the software and running FIM and one without the software but with FIM. That way you have a control system and can run diffs on files which have changed to see the exact changes being made by the software...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.