CaYaTrace 0.5.1 — the removal plan that was empty

If you record system-wide, replace 0.5.0. A system-wide recording produced a removal plan of almost nothing, and no setting could have fixed it.

The removal plan was empty for system-wide recordings

Scope is marked relative to a root process, and a system-wide recording has none. So no process was ever in scope, every observation carrying an actor was discarded, and the only survivors were the handful that carry no actor at all.

Measured on a real recording of an installer: 759,179 file operations and 1,048,112 registry operations went in, and two items came out. Loosening the filters could never have reached the rest — the scope they were being tested against did not exist.

Scope cannot be the filter when there is no subject. Removing it outright was not the answer either: the machine is busy during any recording, and doing that filled the plan with Delivery Optimization counters, Explorer's pane state and Defender's timestamps.

What separates them is the signature of whatever made the change. All of that housekeeping is written by something Microsoft signed, and nothing a third-party installer drops is. The machine's own churn is excluded by who did it rather than by where it landed — which needs no list of paths to keep current, and cannot accidentally exclude a program that installs itself somewhere unexpected.

The same recording now yields 1,264 items — 536 individual files, 351 registry values, 375 keys — including the subject registering itself under SafeBoot\Minimal, which is how a program arranges to keep running in Safe Mode and was missing from the plan entirely.

Download

CaYaTrace.exe — one file, no installer. Right-click → Run as administrator for kernel tracing.

SHA-256  1665A83FFAAF4E0E01BCB34492BF1C58DD211976931C6FCE7D502133AC0701F7

Authorized use only — see SECURITY.md.