How do programs know if they've been downloaded before?

Those free for 30 days programs leave something lying around on your computer to tell them not to let you just uninstall after 30 days and reinstall. What do they put where?

I believe (on Windows systems) they usually stick some obfuscated entry somewhere in the registry.

Guess I could use a File Differences tool to find out what changed.

I’m just curious because I’ve written programs from time to time and never knew quite how to tell. I usually resorted to having the download replace itself with a dummy file, which would generally work for the kinds of customers I get, which aren’t techies.

Usually it’s the system registry where they stick a file, but not always. These programs hide files and look for them.

You can use programs like Sandboxie, which is really a type of anti-virus device to see how these file locations work. Basically Sandboxie traps all the files in a designated location on your computer, so if somethings infected you can wipe it out and it can’t spread. Some programs refuse to work with Sandboxie 'cause of the ability to cleanly wipe out everything.

Some use combinations of things like IP addresses, registry edits and “hidden” files to determain if you used their program before.

If you’re really curious, and somewhat technically inclined, you can use Process Monitor from Microsoft (was SysInternals) to see what’s being written to the Registry and local file system. Aside from this scenario, Process Monitor is an amazingly handy tool for troubleshooting all kinds of Windows issues.

Having spent time working as an application packager gives an insight to how this is done. An application packager uses a tool (like Package Studio) to record the state of a computer (including all registry entries and files) before installation, and then compares the state of the system after installation to find the differences, to create a package.

It is trivial to capture a baseline, then install, use and remove a time limited demo, and finally run a second scan to find the changes that remain for subsequent installs. I’ve done it many times, and it is far easier than trying to use Process Monitor (which is also one of my favourite tools for tricky installs/problems).

Si