During a snapshot the current state of registry key (and its children) is exported into an XML file. During an M-I difference the registry key is re-exported and compared against the original XML file. The standard XML differentiator is used to generate differences between these files.