CaYaTrace 0.5.3 — the plan now contains the program
The removal plan was removing a program's registry footprint and leaving the program on disk. This is the fix for that, and for four things around it.
The plan never contained the program
Everything in it came from watching the recording, so it could only ever hold what the subject created while being watched. A subject is normally downloaded, unpacked, and then recorded — its own executable and the folder it unpacked into already existed, and no event names them as created.
Measured on a real session: two registry values, and not one of the executables that had done all the work.
The program itself is a candidate now — its image, every image its process tree ran, and the contents of the directory those sit in, whether or not the recording watched them appear.
Windows' own binaries never are. A batch file that launches cmd.exe has not made cmd.exe its own; being inside the subject's process tree does not transfer ownership of a binary. The first attempt at this offered cmd.exe and conhost.exe for deletion, because a bare image name with no directory in it passes every check written to recognise a system location.
File by file, not folder by folder
Each file beside the executable is its own item. The directory is offered only when everything in it belongs to the program — a folder is a container, and a container can hold something you want. A program run out of Downloads never takes Downloads with it; one unpacked into its own folder takes the folder.
Your own folders are no longer offered
The guard added in 0.5.2 did not work. It compared raw paths against the folders of the machine reading the session, so a session recorded on one machine and read on another compared two different profiles and decided they were different. It also only covered directory-create events — and opening a directory is reported as a file create, which is the event that was actually firing.
Both fixed: compared on the tokenised path, applied to both events.
No more "protected — will not be touched"
Making a refusal visible by leaving it in the plan was the wrong place for it. One recording produced 107 registry keys under SystemCertificates, all Windows' own and all unremovable, burying the real findings. They are counted and reported now, not listed.
The plan options can be clicked
They were disabled from a session flag whose state went stale. Two fixes for that did not hold, so they are simply never disabled — they are choices about what a future plan should contain, setting one before a session is open costs nothing, and disabling them bought no safety.
Sample data from real investigations is anonymised throughout the repository. A real indicator in a public repository is both a disclosure and a pointer back to what is being investigated.
Download
CaYaTrace.exe — one file, no installer. Right-click → Run as administrator for kernel tracing.
SHA-256 974B14066CED1FA977EE1F5E5B481F656CCD3416E8B1146E0B34B8C727F60011
Authorized use only — see SECURITY.md.