powershell

Prove what changed: registry snapshot diffing anyone can run

Before-and-after exports plus Compare-Object give you ISO-grade evidence for whatever tweaked your system. The two-command technique that closes every argument.

ProofTune Project··4 min read
PowerShell illustration PowerShell

The two commands

terminal / powershell
reg export HKCU pre-hkcu.reg /y        # before
reg export HKCU post-hkcu.reg /y       # after

PowerShell-side comparison without text noise (reg export format is UTF-16; read it through):

terminal / powershell
$pre  = Get-Content pre-hkcu.reg  -Encoding Unicode
$post = Get-Content post-hkcu.reg -Encoding Unicode
Compare-Object $pre $post | Format-Table -Auto

Practice advice

  • Keep both files timestamped. The auditable value is sequencing: “changed between 14:03 baseline and 14:19 trial.”
  • Filter by key prefix when scoping: diff full hives when hunting for mystery changes; prefix-filter when evaluating one tool's footprint.
  • Delete-on-appear lines matter: a paste of [-name-] line-removal markers is evidence of deletion; false “nothing changed” reviews come from people diffing only additive changes.

Run once before any new app trial and you'll never “feel like it changed something” without a literal diff to confirm or dismiss it.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.
ProofTune logo

See these exact settings inside the real tool

The browser replica runs the same strings and states as the installed app — click around before you ever install anything.