How can I identify files installed by an installer on Windows?

Solution 1:

You have 3 main options:

1. Take a snapshot of the filesystem before installation and after, then compare the 2 to see what's changed. SpyMe Tools can make this task easier.
2. Use a program to watch the filesystem for changes and log every operation in real time while the installer is running. Sysinternal's Process Monitor is the one of the premiere tools for this task.
3. Tear the installer apart (how depends on the installer technology), and find out exactly what it's supposed to do.

Of note: The first 2 options are sensitive to other things going on with your PC while the installer is running. You can end up logging or noticing changes that don't apply to the program you're using. However, they also have the advantage of being able to continue logging/monitoring while you run the program, when it might create default data files/registry keys and distribute them throughout the system.

Tearing apart the installer can let you see exactly what it's supposed to do (and undo, if you can also resolve the uninstaller), but not what the program itself is going to do while you use it.

Solution 2:

I have used Sandboxie for this purpose. I created a fresh sandbox and did nothing but install a program into it. Then you can inspect that Sandbox's folder ('C:\Sandbox' by default, I believe) to see every file that got modified.

I usually want to know what an installer is doing because I don't yet trust it, so with Sandboxie I get the additional benefit of being able to wipe the entire program without leaving any traces by simply destroying the sandbox.

Solution 3:

You can use a freeware called Universal Extractor to extract everything contained in an installer. You can then search the individual files on your file system (Program Files, Documents and Settings, system32, etc.). Quite laborious, but often the easiest solution.