CaYaTrace 0.5.0 — request contents, and a sweep for leftovers
Two things the tool had the data for and would not show.
The contents of GET and POST requests
The requests table listed a method, a URL and a size. The headers and the body were in the session all along — written there by the proxy — with nothing in the view able to reach them, so a POST that uploaded 45 bytes was a row saying 45 bytes.
A row now opens to show every header it carried and a button for the body. Both travel with an exported report, so this works in a report you send to somebody else.
A sweep for what a program left behind
This is why removal was skipping things, and why loosening the filters was never going to fix it.
The plan is built from the recording: every item in it is something the tool watched being created. That is the right foundation and it cannot be the whole answer — a program installed before the recording started, or a component dropped by an installer that ran outside the traced scope, was never observed, so no filter setting could ever include it. The observation does not exist.
The sweep asks the opposite question: what on this machine is named after it. Four depths, because how hard to look is your choice and each one matches more loosely:
| Depth | Looks at |
|---|---|
| None | only what was recorded, as before |
| Safe | directories and registry keys carrying the name |
| Moderate | also uninstall entries, services, App Paths, startup values, scheduled tasks — matched on the names a person recognises, not the GUID the key is filed under |
| Advanced | also registry values anywhere under the software hives whose data points at it. Slow, bounded, and it says when it stopped early |
Nothing in it deletes. It produces candidates carrying the reason each one matched, every one still passes the safety policy, and you approve the plan. A sweep that matched too widely is a list to uncheck rather than damage — that is the only arrangement in which an aggressive search is safe to offer.
The terms it searched for are shown, so an unexpected match is explainable. A name with nothing distinctive left after the common words are stripped produces no sweep at all rather than a sweep of the whole machine.
A refused item stays in the plan, marked
It used to be dropped. Comparing the plan against what was still on the machine, you had no way to tell something the tool had not found from something it had decided not to touch — a gap to report versus a judgement to argue with, both arriving as silence. The runner still refuses it; this changes what the plan says, not what it does.
Download
CaYaTrace.exe — one file, no installer, no runtime to install. Right-click → Run as administrator for kernel tracing.
SHA-256 01BE9CFC2B7978F6680FE67A7F820A29A9CADD49133F384CEB6B8C10A18A88C8
Authorized use only. Recorded sessions can contain credentials, tokens, cookies and personal data — see SECURITY.md.