I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.

VMware ThinApp is the closest thing I can find to this as it shows what was modified between the 2 images as it is trying to create a Virtualized Application. I am not interested in making an virtualized application, I have been using the power of the application to determine other items but would like to know if there are better programs and tools for this type of work.

I do know that some virus can detect being ran inside a VM and will not execute.

  • 1
    You could try a malware sandbox like cuckoo.
    – Zzz
    Commented Jul 23, 2012 at 13:15

3 Answers 3


Try using the applications listed on this page


Install the software and take snapshots before infecting the machine.

After the machine is infected, take another snapshot for comparison with the original.

I have found InstallWatchPro to be useful in my investigations.


Just a quick hint, you can always use a hardware machine and make a binary copy of the hard drive. Both copies will need to be compared. You can do this by running a checksum. Just be sure nothing is run from the hard drive.

I think backtrack has a nice toolset to do such analysis. You can find them under digital forensics.


If you are using Unix you could use http://en.wikipedia.org/wiki/Open_Source_Tripwire

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .