v0.5.5 — the place it hid

A program can now be removed from the place it hid

Everything under System32, SysWOW64 and the Windows directory was refused as
Windows-owned. That is right for Windows' own files and wrong for a program that put its
own there — and programs do it deliberately, because it is the one place an uninstaller is
guaranteed not to look.

Measured on a recording of an installer: forty-five files written into SysWOW64 — a
service binary, two libraries sitting beside Windows' own, and a folder of forty more. Every
one refused, and a plan to remove the program that listed six items, none of which was the
program. The recording had seen all forty-five and named the process that wrote each one.

The question is now whose file it is, not which folder it is in, and a recording answers
that: it was not there when the recording started, and the subject wrote it. Windows' own
libraries are never created during a recording.

What still holds the line

• The directories themselves are never removable. No plan can name System32, on any
  evidence at all.

• A list of stores Windows keeps on every program's behalf stays refused whoever is
  recorded writing to them — the signature catalog, the component store, the registry
  hives, the driver store, Prefetch, the installer cache, Fonts.

  That list is not decoration. The same recording produced two creations under catroot2
  attributed to a powershell.exe inside the subject's own process tree: genuinely created,
  genuinely in scope, and absolutely not the installer's. The catalog store is how Windows
  knows whether anything on the machine is signed.

• The verdict is a confirmation, not a permission. These rows are marked in the plan and
  carry their reason, so a path inside a Windows directory can never read like a path on the
  desktop, and the runner re-checks the signature of what is actually on disk before moving
  anything.

On that session the plan went from 6 items to 52, matching what a dedicated uninstaller
found on its own run of the same program — while catroot, catroot2 and Defender's own
platform libraries stayed refused. The previous session is unchanged at 7 items, which is
the check that nothing widened by accident.

A folder is called a folder

A directory is a file with a flag set, so creating one produces an ordinary file create and
the plan listed it as a file. That read wrong and ordered wrong — files are removed before
folders precisely so a folder is empty when its turn comes.

Which entries are folders is now read off the evidence rather than off the disk: anything
other recorded paths sit inside. The answer is then the same on the machine that recorded
the session and the machine that applies the plan, which a disk check could never be.

Download

CaYaTrace.exe — self-contained, no .NET install needed. Windows 10/11 x64.

SHA-256: 2CF0E186BE9616D4D9A614936CBC6A6695C70FDBDCB3E8614438B637DC1B9EE6