Thread: Loging what is writen to harddrive

  1. #1
    Registered User
    Join Date
    Jan 2004
    Posts
    4

    Loging what is writen to harddrive

    Hy ppl,
    I wonder if one can write a prog (either Vb or C or similar) that captures all that is writen to harddisk.
    AT first hand i wanted to write a prog that compares two registry exports. But i soon discovered that regedit-->export doesn´t write all registry entries to file.
    What i want to do is a prog that logs every thing that is writen to harddrive. I need someone to tell me the way how to acomplish this. May it be with interrupt calls (what i think is not able cause windows blocks them) or with an api call.

    Thanks in advance

    --Zhjim--

  2. #2
    C++ Developer XSquared's Avatar
    Join Date
    Jun 2002
    Location
    Ontario, Canada
    Posts
    2,718
    You'd have to create a system-wide hook of some sort. You may want to check MSDN for more info.
    Naturally I didn't feel inspired enough to read all the links for you, since I already slaved away for long hours under a blistering sun pressing the search button after typing four whole words! - Quzah

    You. Fetch me my copy of the Wall Street Journal. You two, fight to the death - Stewie

  3. #3
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,981
    Start your research here.

    gg

  4. #4
    Registered User
    Join Date
    Jan 2004
    Posts
    4
    Thx guys,
    but the stuff with "change journal records" won´t work
    qouted from msdn <a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/change_journal_records.asp">link here</a>
    The change journal logs only the fact of a change to a file and the reason for the change (for example, write operations, truncation, lengthening, deletion, and so on). It does not record enough information to allow reversing the change.

    I looking up the hook stuff.
    Could it made with a prog that starts before windows loads? And when yes where do put it?


    P.S. can u tell me what is wrong with my html for link

  5. #5
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,981
    vB Code Help

    What exactly are you trying to do/accomplish?
    There is probably a better a way.

    gg

  6. #6
    Registered User
    Join Date
    Jan 2004
    Posts
    4
    Thx for the link
    Ok what I want to do is:
    I want to have a program that tells we me which registry entries or files remain after i deinstalled a certain program.
    U know those Trial vErsion , they always know when u installed them and at what date the evaluation period is through.
    Like sad before i tried with comparing two reg files. But not all entries are writen to file. And i also came up with the idea that progs might leave a file to know when the were installed.
    If u got an idea how to acomplish this, let me hear it .
    And to tell the truth i realy would like to log changes to files during a window session.

    regards
    --Zhjim--

  7. #7
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,981
    Obtaining Directory Change Notifications

    Use RegNotifyChangeKeyValue() for monitoring changes to the registry.

    gg

  8. #8
    Registered User
    Join Date
    Jan 2004
    Posts
    37
    You could do it brute force.

    1)Export your registry
    2)Create a list of all the files and directories on your computer
    3)Uninstall or Install the program
    4)Export your registry
    5)Create a list of all the files and directories on your computer
    6)Diff the registry files and the list of files/directories.

    tmode -nopause

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Cheap way to cool down an external harddrive
    By cyberfish in forum Tech Board
    Replies: 13
    Last Post: 06-19-2009, 06:10 PM
  2. Odd harddrive behavior.
    By psychopath in forum Tech Board
    Replies: 6
    Last Post: 04-13-2007, 05:58 PM
  3. Installing Knoppix v3.9 to my harddrive....
    By Pyroteh in forum Tech Board
    Replies: 3
    Last Post: 08-30-2005, 12:40 AM
  4. Quick question about replacing laptop harddrive
    By PJYelton in forum Tech Board
    Replies: 4
    Last Post: 01-20-2005, 08:02 PM
  5. Replies: 2
    Last Post: 03-18-2003, 01:41 PM