New answers tagged file-system
One possible solution would be to take a forensically sound image of the target (entire HDD or a specific area or even the RAM) before and after the program you are wanting to analyze runs. Then simply* compare the two images. I would start with comparing hashes just to be certain something did change (so you dont waste time 'looking'). Many times, ...
Top 50 recent answers are included