- A snapshot of a the registry is 40MB for my laptop (.hiv-file). The idea is to use RegShot to record a shot before and after an installation, then compare the two, and produce a small log file of the differences.
- Easily check which versions of mac OS, iOS, iPadOS, or watchOS are compatible with your Mac model or iDevice. Guide includes OS X 10.8.x to macOS 11.0.x.
- Regshot Equivalent For Mac Os
- Regshot Equivalent For Mac Keyboard
- Regshot Equivalent For Mac Os
- Regshot Equivalent For Mac Operating System
- Regshot Equivalent For Mac High Sierra
- Regshot Equivalent For Macs
[Original post by Amanda Visconti. Minor updates in July 2018 to resolve outdated links and media.]
Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS and Windows operating systems. Python LGPL-3.0 1,100 0 0 1 Updated Dec 23, 2019. File by keywords and appropr iate pattern or MAC (Modify, Access, Creation) times. Registry analysis which uses regshot captures tw o. Conditions, the first is the conditi on when VirtualBox is.
Last week, I wrote about how to forensically image the internal hard drive on a Mac laptop without needing to physically remove the drive. If your workspace doesn’t have the necessary tools to follow that tutorial (a firewire cable, a firewire port on the Mac you’re imaging, and a firewire port on a PC partitioned with BitCurator), we offer an alternative in this post.
Other Options for Imaging Mac Laptops
We recognize that you might not have the correct devices on hand to follow the instructions in the previous post. In that case, you may want to open the laptop to temporarily remove the hard drive for forensic imaging within the BitCurator environment, which means you’ll need a cable that connects a hard drive to your imaging computer (probably a SATA cable). You can also opt to make a forensics image outside BitCurator and then import the image into BitCurator for exploration.
Note that the issue complicating this imaging process is specific to Mac laptops; Linux and Windows laptops wouldn’t require target disk mode and the trouble that causes. Target disk mode works with other Macs (perhaps obviously) and Linux machines; I wasn’t able to get a Windows machine to recognize the Mac laptop in target disk mode. I’ve read that commercial software called MacDrive (currently about $50 for use on one PC) will let you connect the a Mac in target disk mode to a PC, but this would not make the Mac drive also available in the Windows computer’s BitCurator VM; unfortunately, VirtualBox is unable to take firewire input. It’s possible you could get around this issue by using other virtualization software, but VirtualBox is the best free/open-source option.
That leaves us with using either a Mac or Linux machine to create our backup of the Mac laptop; in our example, I used a Mac to create the backups. We’ll walk you through how to first lessen the risk of tampering with a laptop’s insides by securing a forensic image outside of BitCurator.
Why Backup?
Opening up the laptop, removing the drive, and later trying to put everything back risks the laptop refusing to start or otherwise being damaged: maybe you break something, or can’t get things to fit back together. If you don’t have another way to gather a forensics disk image packaged with metadata about the imaging, though, opening the laptop up can be an acceptable risk. All computers fail eventually, and we’d rather have a good forensics disk image of the laptop now, than more years with the laptop working but no forensics image preserved. We thus recommend you forensically image the laptop’s hard drive before opening it, or choose to create a forensics image with one of the non-BitCurator options discussed below and import the image into BitCurator. Opening up the computer is only necessary if none of these forensics imaging programs are right for you, your Mac laptop doesn’t have a firewire port, or if you prefer to do all your forensic work inside the BitCurator environment. For either method, you’ll need a firewire and another Mac (with a firewire port) on which to image the laptop.
Write Blocking
First, we need to protect the laptop from having the connected machine write back to it during the imaging process. This wasn’t a major concern in our example as Larsen’s laptop has already been explored by researchers at MITH—but it’s good practice nonetheless, especially if you use a command-line imaging method, where a simple is-typing could accidentally erase your device. Our WiebeTech Forensic ComboDock works well for most write-blocking purposes, but it doesn’t have the firewire input and output needed to work with a Mac in target disk mode. Tableau T9 Firewire Forensic Bridge is a hardware option that does accept both firewire input and output, but we didn’t have one on hand. We thus used software write-blocking instead, installing Aaron Burghardt’s Disk Arbitrator to protect the laptop.
A Forensic Disk Image
Begin by putting the Mac laptop you want to image into target disk mode:
- The laptop to be imaged (e.g. our Larsen laptop) should be turned off.
- Hold down the t key and turn the laptop to be imaged on.
- Continue to hold down the t key until the target disk mode image appears on the screen (see photo below).
You can now connect your firewire cable to both the laptop to be imaged and the Mac (or Linux computer) doing the imaging.
To create a forensics disk image, there are a variety of free and commercial programs that provide graphical interfaces for Mac and Linux, including MacOSXForensics Imager (Mac) and Guymager (Linux; note that Guymager is the imaging software BitCurator incorporates). Commercial options such as FTK Imager also exist. Almost any program that creates the image in an Encase (E01) or AFF forensic disk image format works, as these formats take a raw disk image and wrap metadata about the imaging around it. We haven’t formally evaluated the effectiveness of any programs outside the BitCurator suite, though, so you’ll want to check potential Mac forensic imaging software out yourself and explore the images they create within the BitCurator environment to make certain they captured your device correctly.
Alternatively, you can choose one of the following command line methods—but it’s of utmost importance that you use a write-blocker with these, as mis-typing could erase your device:
- If you’re very knowledgeable about using the command line, you may already know how to use dd or dcfldd.
- The ForensicsWiki has a detailed tutorial on “Acquiring a Mac OS System with Target Disk Mode” that uses dd and other commands to create a .dmg image, plus instructions on converting the .dmg to an Encase format.
- “Macintosh Forensics: A Guide for the Forensically Sound Examination of a Macintosh Computer” by Ryan Kubasiak offers alternative instructions for using dd (use the hyperlinked table of contents to jump to the “Imaging a Target Macintosh” section starting on page 25).
Opening the Laptop to Remove the Hard Drive
After following these steps to make a forensic image of your laptop, you can either opt to import the forensic image into BitCurator and explore the image there, or choose to temporarily remove the hard drive in order to image it directly through BitCurator. If you choose the latter path, you’ll need to search for instructions like these that show how to open your particular model of Mac. If possible, use a guide with many photos to show you how to carefully open, remove, and replace the Mac laptop’s hard drive. I’ve found that sites dedicated to DIY fixing and making, such as iFixit and Instructables, offer good community-moderated tutorials on opening up computers.
In a future post, I’ll discuss what I found while exploring the Larsen laptop disk image using BitCurator. Send us your suggestions for other difficult-to-image use cases, and we’ll cover them in future posts!
Amanda Visconti is a MITH graduate research assistant on the BitCurator project, where she creates user-friendly technical documentation, develops and designs for the web, and researches software usability. As a Literature Ph.D. candidate, she blogs about her digital humanities work regularly at LiteratureGeek.com.
Usually when software gets installed onto your computer, it copies the needed files and registry entries onto the system for the program to function properly. And when you want to uninstall the software it should but doesn’t always remove everything that was added in the first place. Most of the time there is useless data left over which should have been removed because the uninstaller maybe is corrupted or even badly programmed. Depending on the program and how good the uninstaller is, this could range from one or two innocuous registry keys right up to hundreds of keys and several Megabytes of leftover files.
One way to find out yourself what is getting added to your system during a software install is to actually check the state of your system before the installation, and then check again afterwards to see what has changed. Here’s a selection of 7 tools that can track what file and registry changes are made during a software install by creating and then comparing before and after snapshots of your system, all were tested on Windows 7.
1. Regshot unicodeRegshot is a long running utility that can quickly take a before and after snapshot of the system registry. Also in the more recent unicode version it’s gained the ability to monitor for file changes using CRC32 and MD5 file checksums although this function is turned off by default and you have to go to File -> Options -> Common Options -> and tick “Check files in the specified folders” to enable it.
Only the Windows folder is entered into the list of watched folders so you have to enter any others yourself through the Folders tab. This version also added the Connect to remote registry option.
Regshot is very much a “hands on” utility and is more for experienced or advanced users to quickly check for system changes between two different points in time. Simply create the 1st shot, install the software or run the program you want to watch, and then press 2nd shot. After comparing the differences in the 1st and 2nd shots, it will open an HTML log in your browser listing all the detected changes.
Being only a few hundred KB and portable, Regshot is an extremely valuable tool to have around. The original Regshot is still very slowly being developed and there is a recent beta with separate 32 / 64-bit and ANSI / Unicode versions that can be found at SourceForge.
Download Regshot 2 Unicode
2. InstallWatch Pro
InstallWatch Pro is quite an old utility which works in a similar way to RegShot in that it tracks any changes made to your registry and files between 2 given points in time although this program is more specifically designed for tracking installs. The program is quite detailed in what it can track and includes additions, deletions, or modifications to files and directories, INI files and the system registry.
The good thing about InstallWatch is the easy to read way in which the results are displayed because it behaves just like a standard Explorer window with an expanding tree view of the sections on the left. While the program is running it will detect if you run a setup installer and ask to create a before snapshot, or you can simply click the Snapshot button on the toolbar.
After install, it will ask to create the after snapshot or you can use the Analyze button. The result can then be browsed or individual sections can be exported to text or HTML. All installs are instantly accessible from the tree view and there is also a useful search function.
Download InstallWatch Pro
3. SpyMe Tools
This utility has something the others in the list don’t which is a function to monitor a drive or folder in real time for file changes and could prove a useful addition when doing a bit of troubleshooting. SpyMe Tools is a quite an old program but is still perfectly capable at creating before and after snapshots to watch an install or software for changes.
It does have one drawback though because there is only the facility to snapshot either files or registry, not both together, changeable in the Current Mode option on the toolbar.
Like InstallWatch Pro the interface looks a lot like Explorer so you should feel at home navigating around. The way SpyMe Tools works is slightly awkward because you have to click the Scan button and save the snapshot, install or run the software to track, then click the Scan button again and save another snapshot with a different name.
Both are then tested for changes using the Compare button and the results will show in the window. The differences between the 2 snapshots can be saved as a text file. SpyMe Tools is also a portable program.
Download Spyme Tools
4. InCtrl5
InCtrl5 is an incredibly old tool dating way back to the year 2000 but some users may have heard or used it before, and it can still do a job with a little bit of effort. There are one or two issues with it though which require a bit of knowledge to use the program effectively. First, unsurprisingly InCtrl5 will need to be run in compatibility mode for Windows Vista, 7 or 8.
Secondly, there is an issue with it’s output results for 64-bit users as it won’t display the SoftwareWow6432Node registry keys as coming from there, but will instead show them as coming from simply Software, something to watch out for.
Using the program is pretty easy and it will track changes to the registry, drives and folders, ini files and also specific text files. Inclusions and exclusions can be configured by using the What to track buttons. After selecting the installer you want to track, it will create the before snapshot for you.
Then you install the software and press the Install Complete button to create the after snapshot and the analysis, which could take a little while. The result will then open up a window where it can be viewed or saved as HTM, TXT or CSV files formats.
Download InCtrl5
12Next ›Regshot Equivalent For Mac Os
View All You might also like:
7 Tools to Monitor Software Installs and then Uninstall Removing the Leftovers4 Tools to Decode and Convert Windows Registry Hex Values to Text7 Tools to Defrag and Compact the Windows RegistryHow To Recover and Export Data from Offline Registry Files2 Ways to Convert REG to EXE, BAT, VBS and AU3 to Bypass Registry Editing RestrictionThe free System Explorer systemexplorer.net and has also a Snapshots tool to record and compare changes in files and/or registry.
ReplyMy favourites were always Advanced Registry Tracer [ART] & Advanced Registry Monitor [ARM].
They both have a “create redo reg” & “create undo reg” feature.
From memory they [or only one of them] can detect file size increase/decrease/modified & file date changes too.
Its been a while but Advanced Registry Tracer’ System requirements for ART states it can support current windows versions.
Mark.
ReplyProcess Monitor works with x64 and 32 registry.
It also can monitor both files and registry at the same time, plus much much more.
It’s free, and you can get it from Microsoft.
It replaced RegMon and FileMon tools.
You can download it from the following link:
technet.microsoft.com/en-us/sysinternals/processmonitor
The only downside is that because it has so many extra capabilities, it’s not as user friendly as older registry tools. It does come with a great help file, and once you get the hang of it, you’ll never look at older registry tools the same.
ReplyWe’ve mentioned Process Monitor in other articles and its real time abilities.
Sadly there’s far too much useless information and filtering needed for it to be used as a before and after snapshot comparison tool.
ReplyI want to compare two snapshots of virtualbox and I want to know that is there any tool that can show me the difference among registry as well as file structure
ReplyMany thanks, this article helped me find something in the registry.
Reply
Great information shared !
I will add one more comprehensive tool named Lepide File server auditing tool which also provides the way to track every critical changes/access made on file server into real time.
Hi,
spy me Weblink is not working anymore
Regshot Equivalent For Mac Keyboard
ReplyMany thanks for the article. I tried SpyMe Tools and it worked fantastically. Was able to easily collapse registry keys for changes that I could easily rule out, and it made it far easier to locate the keys I was looking for.
The biggest issue was figuring out how to use the program. Pressing the scan button seems to scan, but doesn’t show any output so I couldn’t figure out what to do from there. Eventually I saved the scan results (even though none showed) and then ran another scan, again nothing showed, saved those results, and then ran a compare and browsed manually for the files. Aside from that the ui and functionality seems great, my new favourite.
ReplyAny of those software would help me to keep track of changes after the software is installed?
For example… 30 days trial software. If change os dates does not work to avoid end of trial period is because it’s storing something on the registry probably at every usage.
I would like to see what was changed after the execution of a software.
Any of thsese soiftware would help me?
Thank you in advance!
Take care!
The version of Regshot listed in the article is old.
X-Regshot 2.0 can output .reg DIFF files when taking into account 2 registry comparisons.
winpenpack.com/main/download.php?view.750
The only trick is to change the default language from Russian to English, the flag button in the bottom right on first startup.
Regshot 1.x leaves a lot to be desired unfortunately.
ReplyIt appears you have got confused somewhere, X-Regshot IS Regshot with a rather pointless WinPenPack splash screen tagged on.
We link to both versions (1.9x and 2.0.xx) and are talking about the same Unincode version X-Regshot uses…
Regshot Equivalent For Mac Os
Replythe last freeware version of Total Uninstall is still available ( not at the authors’ site) and it’s all I’ve used for about the last 10 years
ReplyYeah, we’ve talked about that in another article dedicated to uninstall monitors…
raymond.cc/blog/monitor-software-installs-remove-leftovers-install-monitor/
ReplyThanks.
ReplyI want to know if any of these programs would help me to get a .reg of the installed software, so when i install simples programs, and i have to reinstall windows any time, i wouldn´t have to reinstall my software too, but just merge my .reg file and i get my little sofware working again
ReplyI think a few of them do what you ask, but RegShot is probably the easiest to use.
After running the 2nd snapshot and comparing, look in the Report folder (usually C:Hive) and find the RedoReg.txt file. That’s the difference file and you simply rename the extension to .reg and import into the registry later.
ReplyHey I just downloaded that Regshot Unicode and it’s some strange version from 2010 2.01.70 when the build at source forge is 1.9.0.281 from the Regshot team dated 2/2/2013
What gives and who compiled that “Regshot 2” version in Russia?
ReplyThe Regshot Unicode version was a fork of the original Regshot after it was pretty much abandoned for something like 3 or 4 years. It’s been around since 2010 and many people prefer it for the extra functions and unicode support. Unfortunately the website for it is now gone.
ReplyBoth InstallWatch Pro and Systracer output the changes between before and after snapshots as reg files. Unfortunately the free version of InstallWatch Pro is limited in that a record of deleted registry keys and values is not available. The full version had this feature, but after much searching using Google I have not been able to locate it.
ReplyI scanned InstallSpy 2 with VirusTotal.com and it’s showing a possible infection. Can anyone confirm?
ReplyThat’s definitely a false positive, the creator and host of the file, 2brightsparks.com, is a well respected software developer. 1 out of 46 at VirusTotal is classic false positive territory.
ReplyThank you so much. I recently performed a complete system restore, only re-installing 8 programs. Now, I have to temporarily install more programs. Hopefully, I will never have to restore my computer again with this.
ReplyThis is awesome info. Thanks alot I only knew about a few of these tools.
ReplyThank you very much for your useful post!
It is just what I want.
this is a great article, but i’d be interested in hearing which is the #1 choice for the author after testing all them. :-/
ReplyRaymond Rules….
ReplyThank You…
ReplyThanks Ray!
Replythanks ray..
ReplyRegshot Equivalent For Mac Operating System
Since I began to use Total Uninstall (1 year ago) I never had to reinstall Windows! This program really removes everything! Windows will be in top shape no mater how many apps you install/uninstall! This kind of application is excellent to keep bloatware and crapware under control.
ReplyThanks man, its great tutorial. I always wanted to keep my system clean and I am gonna use Total Uninstall.
Thanks!
ReplyThis is great. Thanks a lot. I used to know about FileMon and RegMon only.
ReplyTotal Uninstall is what I use, but thanks for rest of the softwares, great tips no doubt, cheers mate!
Comments are closed.