UPDATED ON: July 15, 2010
There are two steps for using WhatChanged:
1) First, take a snapshot to get the current state of the computer;
2) Second, run it again to check the differences since the previous snapshot.
WhatChanged uses the "brute force method" to check files and the registry.