I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there an alternate to this that will capture deleted files?
I imagine this will need to work at the Kernel leverl for API hooking as well. I have looked at a couple of alternatives including using PowerShell to monitor file changes (http://dereknewton.com/category/powershell/) and also to use the WMI process for logging data, but neither of them are a great solution and I want all captured files that the malware attempts to delete.
Does anyone know of a tool that will work on Windows 7 for this?