Loging what is writen to harddrive

Hy ppl,
I wonder if one can write a prog (either Vb or C or similar) that captures all that is writen to harddisk.
AT first hand i wanted to write a prog that compares two registry exports. But i soon discovered that regedit-->export doesn´t write all registry entries to file.
What i want to do is a prog that logs every thing that is writen to harddrive. I need someone to tell me the way how to acomplish this. May it be with interrupt calls (what i think is not able cause windows blocks them) or with an api call.

Thanks in advance

--Zhjim--

You'd have to create a system-wide hook of some sort. You may want to check MSDN for more info.

Start your research here.

gg

Thx guys,
but the stuff with "change journal records" won´t work
qouted from msdn <a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/change_journal_records.asp">link here</a>
The change journal logs only the fact of a change to a file and the reason for the change (for example, write operations, truncation, lengthening, deletion, and so on). It does not record enough information to allow reversing the change.

I looking up the hook stuff.
Could it made with a prog that starts before windows loads? And when yes where do put it?


P.S. can u tell me what is wrong with my html for link

vB Code Help

What exactly are you trying to do/accomplish?
There is probably a better a way.

gg

Thx for the link
Ok what I want to do is:
I want to have a program that tells we me which registry entries or files remain after i deinstalled a certain program.
U know those Trial vErsion , they always know when u installed them and at what date the evaluation period is through.
Like sad before i tried with comparing two reg files. But not all entries are writen to file. And i also came up with the idea that progs might leave a file to know when the were installed.
If u got an idea how to acomplish this, let me hear it :) .
And to tell the truth i realy would like to log changes to files during a window session.

regards
--Zhjim--

Obtaining Directory Change Notifications

Use RegNotifyChangeKeyValue() for monitoring changes to the registry.

gg

You could do it brute force.

1)Export your registry
2)Create a list of all the files and directories on your computer
3)Uninstall or Install the program
4)Export your registry
5)Create a list of all the files and directories on your computer
6)Diff the registry files and the list of files/directories.

tmode -nopause