Checking previous sw installed in a computer


omega

New Member
Dec 19, 2007
6
0
#1
Dear All,

I am new to this forum and wish to seek some help from fellow experts here.

Is there a software that I can use that could tell me what software are previously being installed on a computer?

The reason I am asking this is that, I am trying to prove that a particular company has exceed in using the amount of software license they bought.
I know we can do a check by going to the Add/Remove Programs to see what software are being installed. But what I am worried is that these computers may have been running the software before and may have remove the software before a search is done on all the computers.

Is there a tool that can show previous software that was installed in the computer?

And for example if the company has 100 computers, is there a speedier and automatic way to check all 100 computers for a particular software that has been installed than having to go through each of the PCs manually to check it?

Hope somebody can answer my question.

Thanks
 

cybercop

Administrator
Oct 31, 2005
1,660
0
#2
I take it from the wording you are not the author of this software. If you were the author, you would know what the software does and where. I would recommend using software that monitors the registry and do a test install. That will tell you what keys the software uses in registry. Then uninstall the software and check those keys again. Most uninstallers are sloppy at best and leave some keys in the registry. Some do it on purpose. Either way, there should be keys left behind. Then the easy way to test would be to write a script to check for the keys you know are left behind.
 

mialta

New Member
Nov 20, 2007
48
0
#4
Applications installed

<t>Try Psinfo if you know the admin password.<br/>
<br/>
technet.microsoft.com/en-gb/sysinternals/bb897550.aspx<br/>
<br/>
You can script it at login if you have a network and admin access. <br/>
<br/>
Mike</t>
 
Nov 8, 2007
9
0
#6
InstallWatch records modifications made to your PC during the installation of software, hardware, or configuration changes.

I recently used this software.
1-You create a baseline report of the system.
2-You then install the software
3-Install Watch provides a completed report detailing all changes/additions/deletions to files and the registry.
4-This software can also run in monitoring mode, and will take a snapshot when new software is installed.

www .epsilonsquared.com

You may can information from restore points. See below.
http ://128.175.24.251/forensics/restorepoints.htm

I have to check, but I think I have a Pearl Script, that will show what software has been removed/un-installed. Will post details latter.
 
Sep 2, 2004
70
6
#7
Generally speaking, the Registry can be used to track software that has been installed via some kind of installation package, such as MSI. You can expect to find the appropriate entries in the Uninstall key.

However, some software also creates a vendor key within the Software hive, and you may find references there...I've noticed that these keys aren't always removed completely.

There are a couple of ways to see software that had been previously installed then uninstalled. On XP systems, query the Software Registry hive files located in the Restore Points. On all systems, you may find that a user ran an uninstall routine if you check the contents of the UserAssist key within each NTUSER.DAT file.

This generally isn't something that you'd want or be able to do via live systems, due to permissions on various directories and files.

HTH,

Harlan
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu