# How do programs know if they've been downloaded before?

**URL:** <https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323>\
**Category:** Factual Questions\
**Created:** [August 13, 2009, 7:46pm UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323 "2009-08-13T19:46:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![the\_first\_supraliminal](https://avatars.discourse-cdn.com/v4/letter/t/f475e1/32.png) [@the\_first\_supraliminal](https://boards.straightdope.com/u/the_first_supraliminal)\
**Post date:** [August 13, 2009, 7:46pm UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/1 "2009-08-13T19:46:04Z")

</div>

Those free for 30 days programs leave something lying around on your computer to tell them not to let you just uninstall after 30 days and reinstall. What do they put where?

---

<div class="post-metadata">

**Author:** ![Indistinguishable](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@Indistinguishable](https://boards.straightdope.com/u/Indistinguishable)\
**Post date:** [August 13, 2009, 7:46pm UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/2 "2009-08-13T19:46:26Z")

</div>

I believe (on Windows systems) they usually stick some obfuscated entry somewhere in the registry.

---

<div class="post-metadata">

**Author:** ![the\_first\_supraliminal](https://avatars.discourse-cdn.com/v4/letter/t/f475e1/32.png) [@the\_first\_supraliminal](https://boards.straightdope.com/u/the_first_supraliminal)\
**Post date:** [August 13, 2009, 7:52pm UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/3 "2009-08-13T19:52:41Z")

</div>

Guess I could use a File Differences tool to find out what changed.

I’m just curious because I’ve written programs from time to time and never knew quite how to tell. I usually resorted to having the download replace itself with a dummy file, which would generally work for the kinds of customers I get, which aren’t techies.

---

<div class="post-metadata">

**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\
**Post date:** [August 13, 2009, 8:42pm UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/4 "2009-08-13T20:42:22Z")

</div>

Usually it’s the system registry where they stick a file, but not always. These programs hide files and look for them.

You can use programs like Sandboxie, which is really a type of anti-virus device to see how these file locations work. Basically Sandboxie traps all the files in a designated location on your computer, so if somethings infected you can wipe it out and it can’t spread. Some programs refuse to work with Sandboxie 'cause of the ability to cleanly wipe out everything.

Some use combinations of things like IP addresses, registry edits and “hidden” files to determain if you used their program before.

---

<div class="post-metadata">

**Author:** ![DarrenS](https://avatars.discourse-cdn.com/v4/letter/d/977dab/32.png) [@DarrenS](https://boards.straightdope.com/u/DarrenS)\
**Post date:** [August 14, 2009, 4:59am UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/5 "2009-08-14T04:59:08Z")

</div>

If you’re really curious, and somewhat technically inclined, you can use [Process Monitor](http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) from Microsoft (was SysInternals) to see what’s being written to the Registry and local file system. Aside from this scenario, Process Monitor is an amazingly handy tool for troubleshooting all kinds of Windows issues.

---

<div class="post-metadata">

**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\
**Post date:** [August 14, 2009, 9:12am UTC](https://boards.straightdope.com/t/how-do-programs-know-if-theyve-been-downloaded-before/506323/6 "2009-08-14T09:12:35Z")

</div>

Having spent time working as an application packager gives an insight to how this is done. An application packager uses a tool (like Package Studio) to record the state of a computer (including all registry entries and files) before installation, and then compares the state of the system after installation to find the differences, to create a package.

It is trivial to capture a baseline, then install, use and remove a time limited demo, and finally run a second scan to find the changes that remain for subsequent installs. I’ve done it many times, and it is far easier than trying to use Process Monitor (which is also one of my favourite tools for tricky installs/problems).

Si
