CaYaTrace 0.5.2 — it offered to delete your Documents folder

Update if you use Remediate. One of these could have deleted your Documents folder.

The plan offered to delete your own folders

The kernel reports a directory create when a program opens a directory with a create disposition — which is what every program does to a folder it is about to read. That is indistinguishable from actually making one.

So a program that merely looked inside Documents produced an event reading "created by", and Documents appeared in the plan ticked, alongside the profile root, the desktop and the Internet cache.

Folders Windows maintains are no longer candidates. Resolved from the running machine rather than matched against a list of names — a profile can be redirected to another drive, and a name comparison would miss it in exactly the case where deleting it costs the most. A directory the program genuinely created is still offered, and there is a test for each half: a guard like this is easy to write in a way that quietly refuses everything.

Remediate said no session was loaded when one was

The build button and the three plan options are enabled from the loaded session, and nothing re-evaluated that when the view was opened. An operator who had just finished a recording arrived at a view telling them no session existed, with every option greyed out and no way to build a plan. Re-evaluated on entry now.

Download

CaYaTrace.exe — one file, no installer. Right-click → Run as administrator for kernel tracing.

SHA-256  21724B7A724366C90F07EED2D685A502A2C7FF5E84873338077FA0D2FDE79ECE

Authorized use only — see SECURITY.md.