Viruses can spread copies of themselves and infect other programs, and can leave trails on the disk. They can also infect the mbr. Then there's ransomware which encryptes files on disk. These are all examples of malware that could be detected by diffing the disk. Of course, if it doesn't touch the disk, then you're left with network traces.

I'm not saying they don't it just not the most interesting thing you may want to look at ;) Anyhow don't bother with even trying to use physical machines as your primary platform, VM or better instruction level emulation is the way to go, not foolproof but it is at least scalable and flexible enough.

You also seem to conflict what detection means, detection can be easy "is this a known binary" if not > malware can be a pretty easy (if unrealistic) classification, when researchers talk about detecting malware we are talking about understanding what it does.

Diffing disks isn't really going to get you far.