I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically analyze a software for the files which software deals with. is there any software available to do this? Am using Windows machine.

4 Answers 4


I'd suggest that you could use Process Monitor from the sysinternals suite to do this.


I'd recommend using a FIM (File Integrity Monitoring) tool. This will let you take a snapshot of your system before you make changes, and then another snapshot after you make changes - then you can to see what files and registry entries have changed inbetween snapshots.

OSSEC is an Open Source system that can monitor files and registry objects for changes. It's certainly not the easiest to configure and use, but it is free, and works on Windows and Linux.

Ionx Verisys is a commercial file integrity monitoring system for Windows, Linux and network devices that has the advantage of having a central GUI for configuration, reporting etc - so it's a lot easier to setup and operate than OSSEC. This one definately monitors both files and registry entries.


You may need to use a File Integrity Monitoring tool to look at the directories the software may affect. The FIM will monitor for creation, modification and deletion of folders/files in those locations and provide a report. However, it may tell you that changes have been made but not what are the specific changes.

You could run 2 separate systems; one running the software and running FIM and one without the software but with FIM. That way you have a control system and can run diffs on files which have changed to see the exact changes being made by the software...


Yes, File Integrity Monitoring is the right solution. You can track all file changes, adds and deletes including details of the user account making the change, the process used and reports of any file attributes that have changed.

If the files are text-based you can also see the details of changes, but for binary files or images, the best option is to use hash-based tracking to detect file changes.

NNT Change Tracker does a good job of all this and covers other configuration elements such as registry keys/values, services, processes, installed software, command outputs, network port changes, firewall rules, group policy - you get the picture :-)

  • Hi, and welcome. This is just on the edge of being self-promotion. The question asked for a product, and you provided one. We normally close questions asking for products, and the other answers provide products, too. I've closed the question, and I'll leave your answer because you disclose your relationship, and it is in the same stream as the other answers. Just know that we normally jump on self-promotion pretty hard.
    – schroeder
    Jan 6, 2017 at 14:28

Not the answer you're looking for? Browse other questions tagged .