Monitor Registry And File Changes with What Changed

Martin Brinkmann
Aug 19, 2008
Updated • Jan 15, 2018

What Changed is a free program for the Windows operating system that provides you with options to compare system snapshots to find out which items have been changed in the Windows Registry and a file path.

Every software installation and system update has an impact on the computer's file system and the Windows Registry. That's most of the time intended and necessary to run the software program or operating system properly.

Some tools, however, add data to the system that could be - at best - classified as unwanted and at worst seen as malicious.

Adding a program or service to the system startup list without asking the user for permission or adding a system icon to the list of devices is another. Monitoring those Registry and file changes can be helpful in analyzing why something happened and where it's source is located.

Also, programs like What Changed provide you with information that something has changed, been added or removed from the machine something that you may not find out about otherwise.

Monitor Registry and File changes with What Changed

Note: The author's homepage is no longer available. We have uploaded the latest working version of WhatChanged to our server. Click on the following link to download the program: (Download Removed)

Please note that we don't support the program in any way.

What Changed is a portable system application that can take system snapshots of the Registry or file system so that you can compare two snapshots at a later point in time to find out what changed in the meantime.

This is highly useful during software installation as it records the changes the installation of a program made to the system. You would create one snapshot before the installation of the software, and another right after it to list all the changes made by the application to the system.

The computer's file system and the parts of the Registry that you want to be scanned for the system snapshot can be selected in the program interface. Taking the Registry and system snapshot takes a while depending on the size of the hard drive and the number of files stored on it, but it is quite fast usually.

The program stores the data in a text file in the folder it has been executed from.

You use the same interface to create a new snapshot to compare it with an older one. Simply click on "step #2" in the interface to create a new snapshot and run a comparison.

What Changed highlights the changes found while it is creating the second snapshot. Please note that it is necessary to select the same scan preferences for the comparison to work, as you'd end up with unrelated or missing items otherwise.

The changes are saved to a snapshot file in the same directory as the application. It's a simply text file that points to Registry keys and files that have been changed or added.

Closing Words

What Changed is a simple application for Windows. It is portable which means that you can run it from any location, and compatible with all recent versions of the Windows operating system.

It is useful in determining the changes made by a software installation on the system, or an operating system upgrade, as it reveals those if you define the parameters correctly.

software image
Author Rating
5 based on 2 votes
Software Name
What Changed
Operating System
Software Category

Tutorials & Tips

Previous Post: «
Next Post: «


  1. Robert From Boston said on July 17, 2020 at 7:08 am

    P.S. .. Oh! I forgot “FileWatch”, by Kevin Gearheart. That was a real goodie as well!! Anyone remember that one??

  2. Robert from Boston said on July 17, 2020 at 7:04 am

    I first came across what I call “system change tracking” programs perhaps 20 years ago. There was an absolutely awesome program called “Tiny Watcher” that (if I remember correctly) would either do a registry and file system snapshot and comparison every time you started Windows (or maybe whenever you just logged on, if you were resuming from hybernation state), or you could tell it to do it’s thing at random times whenever you wanted. It was completely fascinating to see all the changes that were created that I would have otherwise had no clue about. One of the best things about this program was that you could create an “ignore list” of folders or registry keys that changed a lot just in the course of normal use of the pc. The ignore list was very useful in eliminating spurious data changes that were inconsequential.

    I do remember that at some point TinyWatcher was no longer recommended for the system or machine I had upgraded to — either because it didn’t handle 64-bit architecture easily, or had some problem with Vista and Windows 7 changes. When TinyWatcher seemed to be no longer a tool I felt comfortable with I did use RegShot 2 for a while. There was another similar program called PRIMO (PRogram Installation MOnitor) that was based on RegShot, as well. I haven’t really kept up with these type of programs for a long long time now, but I think one other one that may work pretty well still is MJ Registry Watcher. There’s actually been many programs that do this in one way or another, with varying degrees of success (or failure, or inconveniences, lol). I found them a very interesting way to get an in-depth view of the inner workings of Windows, and might even resume that “hobby” if I had a bit more time on my hands. Fun stuff, for the geeky among us ;-)

    Stay safe, all….

  3. bahun said on December 27, 2010 at 11:32 pm

    lol, nice program, but…i will probably be faster with eye compere through registry

  4. limaj said on December 12, 2010 at 3:10 pm

    How can I monitor windows registry in real time? I want to see the changes that is made on registry after opening file, renaming icons etc. How can I do that?

    1. Mike said on December 21, 2010 at 9:19 am

      @limaj: Something called process monitor (procmon.exe) from SystemInternals will do that for you. SystemInternals is owned by Microsoft, so you know they don’t make crappy 3rd-party skunkware tools.

  5. kr3ob said on April 7, 2009 at 2:27 pm

    dear sir
    can you please provide me with program?

    thanks in advance

  6. paulw said on August 19, 2008 at 6:15 pm

    I’ve been using Regshot as well, but I tried out What Changed after reading this. Wow, what a difference. It takes Regshot about 15 seconds to take the first scan of the registry on a test computer, while I gave up on What Changed after 8 minutes while it was still scanning classes_root.

  7. dianoga said on August 19, 2008 at 11:05 am

    I’ve been using Regshot, and it’s portable too. I’m gonna be lazy and copy/paste a description from the readme:

    Regshot is a small,free and open-source registry compare utility that allows you to quickly take a snapshot of your registry and then compare it with a second one – done after doing system changes or installing a new software product. The changes report can be produced in text or HTML format and contains a list of all modifications that have taken place between snapshot1 and snapshot2. In addition, you can also specify folders (with sub filders) to be scanned for changes as well.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.