14 DAY TRIAL // Things are moving pretty fast lately. After 12 years in the making the second StarCraft arrives, Facebook is testing a new account deletion approach (one that hopefully gets the job done faster), jailbreaking your iPhone is now legal, just like breaking a DVD’s DRM to use a portion of a movie in your own videos, in certain cases.
Unlike in real life things can change a whole lot faster on your computer by moving files from one partition to another, downloading new information off the web or simply when you install a new program. Not all of these changes can be tracked down by an average user, certainly not by a beginner user, not without help from applications designed to record the changes on your system anyway.
The Internet has quite a library of programs designed to monitor the changes occurring on the system drive, but in most cases limitations are imposed on the number of modifications that can be recorded. Or the manner all alterations are presented is simply not user friendly. WhatChanged attempts to provide an easy way to note any revisions committed to the system.
The application is absolutely free of charge and does not require any installation. It comes with a single-windows interface which includes all the options you need to track down the changes. Looks are not at all impressive in this tool, a clue to its being bent on the functional part rather than aesthetics.
WhatChanged does not work in real time, so it can’t be set to target one location and not pop a message or an alert the moment a modification occurs. It works by the principle of taking a snapshot before and after the change is produced, just like RegShot. In the case of WhatChanged, however, you get to choose which areas should be targeted.
When defining the target areas for the program to scan you can choose for it to scan files on any of the volumes available on the system or registry areas (CLASSES ROOT, LOCAL MACHINE, CURRENT USER and USERS). Having picked the targets you can proceed to taking the first snapshot, prior to any premeditated alteration. During our tests the process did not take too long to complete and at the end we were given the total amount of files that have been taken into evidence.
As soon as the snapshot is taken WhatChanged will create a TXT file containing all the data it recorded in the location of the executable. All the information available in this file is presented in a complete manner which also includes complete paths.
The next step is to make any change you wish in the targeted areas. Depending on your needs, this could mean installation of a new software product, removing data, adding new files, etc. For our testing we created new folders, added some data to the target as well as deleted some files.
Comparing the scan duration for the initial and the second scan of the targets the application took a whole lot longer to complete the second snapshot. During our tests the first snapshot taken to the system partition was finished in about six seconds while the second one completed in over nine minutes. Of course, the entire procedure depends on the amount of data that needs to be checked out and the number of changes recorded.
What is special about WhatChanged is that it serves all the modifications in a separate Notepad document. You will have them presented in the same manner like the items it takes into evidence, with their complete path. Given the simplicity of this program having them displayed this way will have to suffice.
Everything sounds pretty cool up to now, but there is one drawback. If you compare two file scans of the same volume and in-between the sessions you shift-delete some data, this won’t be available in the output log. However, if the files have been sent to Recycle Bin and then eliminated altogether from the system the occurrence will be reported.
One important feature of the program is that it allows you to compare the changes available on multiple targets. This way you can pick more than one volume to be scanned as well as more than one Registry hive. Choosing multiple targets has an impact on the duration of the process.
As far as resource usage is concerned, WhatChanged has a greater impact on the CPU and keeps a very small RAM footprint. In our case the central processing unit was constantly maintained around above the 47% value (peaked at 50%) while it merely nibbled on memory (no around 8MB).
WhatChanged has been created to scan for modified files and registry entries and this is exactly what it does. It is nothing fancy or complex about it as the basic principle it relies on is simple: take a snapshot of the target before the changes occur and one after; then compare the two and extract only the modifications.
It does, however, come with its own set of shortcomings. For instance, it misses the data that has been purged from Recycle Bin. Also, it cannot recognize files that have modified their size. But it comes in handy when you install a new application as it allows you to see what information has been added to the system and its path.
The Good WhatChanged is simple to use and does not require installation. The application is so simple that a glance at the interface is all you need to learn how to use it.
You have a progress bar that shows the data currently being scanned and gives you a hint on the duration of the operation. File copy errors are also recorded in a separate text file so you can review them at any time.
It would be nice to have a progress bar when the first scan goes through all the files. This article is also availble in Spanish: Monitoriza los cambios del sistema Follow me on Twitter @Ionut_IlascuThe Bad
The Truth
