How do I list installed files in Windows?

February 13, 2007 7:49 AM

How do I track all of the installed files when I install new software in Windows?

I need a list of all of the files installed by an executable. Obviously, there's whatever is in the install directory, but I also need a list of any dll's and other system files. This includes existing files that are modified by the installation. Is there a painless way of doing this in Windows, short of going through each directory and looking at time stamps (which is not reliable anyway)? Apologies if this has been covered or is obvious, but searches have turned up nothing.

posted by nightengine to computers & internet (10 comments total)

I think FileMon can do this. Have it running while you run the installer.
posted by matthewr at 8:16 AM on February 13, 2007

It's been years since I used it, but there's a utility designed for sys admins that records the changes made to a computer when you install a piece of software called Norton GHOST ... it's marketed as a backup solution now, from what I could tell on Amazon.

It basically takes a snapshot of the system, then you install the new software, and it will create a package of all the changes made in the interim. At least, that's what it used to do. Sounds like exactly what you're looking for.
posted by Dave Faris at 8:16 AM on February 13, 2007

You shoudl use Inctrl. It's exactly what you need. I've used an older version with much success.
posted by Four Flavors at 9:37 AM on February 13, 2007

InstallWatch is supposed to do this; I haven't used it.
posted by Zed_Lopez at 9:39 AM on February 13, 2007

If these are Windows Installer based setups you may want to grab a copy of Orca, the MSI database editor included as part of the Windows Platform SDK. You can download the Platform SDK Tools here.

With Orca, you can open up the MSI file and see exactly what it's going to do. In particular, you'd want to look at the File and Directory tables.

For non-MSI installers, there are a bunch of different snapshot utilities that will list the changes made. The two that Four Flavors and Zed recommended both work well. The guys who make InstallWatch also make InstallRite, which I seem to recall is a little more full featured.
posted by JaredSeth at 10:21 AM on February 13, 2007

You can use the free version of Altiris SVS to install the program in a layer. It will appear on your real filesystem but will not actually be stored there. Then you can right click on the layer (when deactivated) to view all the installed files and registry entries.
posted by aye at 12:29 PM on February 13, 2007

I'm not sure Norton Ghost is what you're looking for. It's primary function is for imaging entire workstations from one disk to another, not for rolling back single program changes. It could be used to roll back, but you'd also be rolling back everything that happened to the system since you created the image, not just things the program installation routine modified.
posted by odinsdream at 1:06 PM on February 13, 2007

I admit that it's been about 5 years since I used Norton Ghost, and they may have completely changed how it works. But when I used it, you could use it for a complete disk image installation (which is how we mostly used it), as well as a specific program install or update. I thought it was a great program when I used it.
posted by Dave Faris at 4:16 PM on February 13, 2007

The problem with what you are asking for is that there is no one installer that every piece of software uses. Some use MSI, some use InstallShield, some use NSIS, and some are completely home-grown and purpose-built. So there is no easy way to query what files were added or modified during the install, because there's not necessarily any such list stored anywhere, especially in the case of home-grown installers. Most of the solutions suggested above will either work only for software installed by one of those particular installer technologies (e.g. MSI) or they work by monitoring all file access during the install phase, which is a rather brute-force and inexact way of solving the problem.

And even if you got a listing of files, that is only a fraction of what happens during some installs. There are registry keys to be added, DLLs to be registered with the COM system, filetypes registered, shortcuts created, etc. In short most non-trivial installs are very complex actions that involve much more than just placing files in directories. I'm not sure what purpose your intent is with this question, but I think that if you somehow want to uninstall or move programs around just by looking at a list of what files were copied, you will fail very badly.
posted by Rhomboid at 7:08 PM on February 13, 2007

Rhomboids complaints above are in the right view, but he makes it sound much more complex than it is. Everything goes on the hard disc, so you can find out what changed by looking there- some things are easier to figure out than others (shortcuts are the same things as files, dlls & filetype registrations happen in the registry).

If you simply want to be able to roll-back fully then you could jsut use the Windows System Restore Utility. for more power I'd use inctrl or one of the similar brute-force monitors linked above. You could use filemon + regmon to do the same, but far more tediously.
posted by Four Flavors at 12:33 PM on February 15, 2007