We have already covered RegFromApp where you can use it to track real time registry changes by injecting it into the process that you want to trace. Other than tracking what registry changes are being made to a computer, it is also equally important to track the changes on folders. Here is a simple tool called Track Folder Changes which you can use to track real time changes on folders that you specify. By default, Track Folder Changes tracks the whole C:\ drive where normally the operating system is installed. You can easily change the folder that you want to monitor by clicking the browse button. Upon running Track Folder Changes, it instantly displays in real time a tree with the list of created/deleted/changed files in a specific directory and its subdirectories. The coloring on the files helps to easily determine if a file is deleted, modified or created.
Folder monitoring tools can be very useful to track installation or uninstallation changes and etc. In fact it can even be used to detect if there is a keylogger monitoring your keystrokes and saving them to a log file. Remember that Track Folder Changes is able to detect files that are being “modified” which means when the keylogger saves the keystrokes to a log file, Track Folder Changes will be able to catch it. However it will still require human intelligence to determine if the file is indeed used by a keylogger. Below is an example of detecting a DarkComet RAT trojan with keylogging enabled with Track Folder Changes.
A .dc file located in TEMP folder constantly appears to be modified even after clearing the results.
When opened the .dc file with Notepad, it looks like a log file of captured keystrokes.
As useful as it is, Track Folder Changes is not a hardcore tool that is able to work on all situations. I tried uninstalling iTunes and monitor the whole C:\ drive with Track Folder Changes. When iTunes has finished uninstalled, Track Folder Changes stopped responding and Windows Task Manager shows that the process is taking up 100% CPU usage. After waiting a couple of minutes, Track Folder Changes displays the changes and starts to work normally again.
My only gripe is it lacks of a pause button or an option to export it to a log file so that it is easier to analyze the folder changes. If you have a process that is constantly making changes on the files and folders on your Windows computer, there is no way you can track or analyze the changes on files/folders.