Adding an entry to the system startup items without asking the user for permission or adding a system icon to the list of devices is another. Monitoring those Registry and file changes can be helpful in analysing why something happened and where it’s source is located.

What Changed is a portable system application that can take system snapshots and compare those system snapshots with a system state at a later time. This can be highly useful during software installation. A system snapshot would be created before the installation and that snapshot could be compared to the state of the system after the installation.

The computer’s file system and the parts of the Registry that should be scanned for the system snapshot can be selected in the program interface. Taking the Registry and system snapshot takes a while depending on the size of the hard drive and the amount of files stored on it.

The same main interface contains the Compare button which compares a previously saved system snapshot with the current state. The program basically scans the system a second time and compares the first and second snapshot to discover differences.

The changes are saved in a snapshot file in the same directory as the application. It’s a simply text file that points to Registry keys and files that have been changed or added.

Monitoring system changes should therefor concentrate on the core parts of the Windows operating system, say the Windows Registry and the system32 folder in the Windows directory. You find several applications that can monitor selected folders in real time, Winpatrol is one of them.

Tiny Watcher monitors system changes in a different way. It scans the important folders and Registry locations during initial setup and reports on the changes only when it is started again. This has the advantage that no application is monitoring the system in real time which consumes system resources. The disadvantage is that the user will be notified about changes after they happened.

Tiny Watcher is therefor not a real time system protection application, more of a tool that allows a forensic analysis of system changes. It still offers functions to deal with the changes that have been made to the system.

It provides access to a web search to gather information about a change but also to confirm, disable or remove it. Those actions can be problematic, it is generally not advised to delete items unless it is known that deleting them causes no harm. It is normally not a problem to delete a startup entry but it could be highly problematic to delete a file in a Windows folder.

Tiny Watcher works best when executed during system start or closely after. Each action is written in a log file which is – again – excellent for tracing a file or system change.

Tiny Watcher is hosted at Donation Coders. It runs on pretty much every Windows operating system, yes even Windows 95, including Windows XP and Windows Vista. It surely does not look pretty but I’d say functionality > looks all the time.