I was wondering if there is an established way to know what a running particular program on a system might leave behind (in terms of changes to a filesystem, such as in Linux). I am thinking of this in similar lines to how I think a forensics investigation might take place.
The way I thought to approach this problem is similar to how I believe Tripwire works. First by making a hash of directories, find which have been changed, then to narrow down the specific files from those directories that are changed. Then by using a VM with snapshots I can revert to the previous state of the machine and compare future changes with previously recorded changes.
I know that the logging and tmp directories will change naturally anyway. But apart from these is there any way of knowing what is left behind on a system, or is there a better (or smarter) process than the one I am thinking of using?