GhostTrace

Find what software left behind on Windows, before it finds its way back.

GhostTrace is a local Windows forensic trace hunter for incident responders, system administrators, and security-minded power users. It maps persistence, execution, activity, and leftover artifacts into a reviewable record, then offers tightly constrained cleanup only when you explicitly choose it.

Download | Requirements | Quick start | Capabilities | Safety model | Roadmap | Portuguese (Brazil)

---

Why GhostTrace

Uninstalling an application does not always remove its operational footprint. Startup entries, scheduled tasks, cached execution evidence, registry values, services, and folders can remain long after the installer reports success.

GhostTrace turns that broad question into a focused, local investigation:

• One focused hunt across NN forensic modules.
• Evidence by source, with findings, errors, and metadata kept per module.
• Offline by design, with no telemetry, uploads, or cloud dependency.
• Audit-ready output, including TXT records, JSON outputs for directed collectors, and cleanup logs.
• Human-controlled cleanup, never automatic remediation.

Requirements

Item	Requirement
Operating system	Windows 10 or 11, x64
Privileges	Administrator, required to read protected artifacts
Runtime	None. The MSI is self-contained.
Disk	~NN MB installed, plus space for report output

Verify your download

GhostTrace reads protected Windows artifacts and runs elevated. Verify the installer before executing it, especially on a host you are investigating.

Get-FileHash .\GhostTrace-1.5.0-x64.msi -Algorithm SHA256

Compare the result against SHA256SUMS.txt published with each release.

The installer is not code-signed yet, so SmartScreen and some EDR products will flag it on first run. Verify the hash rather than dismissing the warning.

Quick start

Install

Download the latest x64 MSI from Releases:

GhostTrace-<version>-x64.msi

The package is self-contained, so the target machine does not need a pre-installed .NET runtime. Run GhostTrace as Administrator to access protected Windows artifacts.

Hunt a software name

GhostTrace.CLI scan --name nvidia

The interactive flow shows progress, groups findings by technique, and can export a record of the investigation. If safe cleanup candidates exist, you must select them and type a confirmation phrase before any removal occurs.

A trimmed example of what that produces:

$ GhostTrace.CLI scan --name nvidia

  MODULE                        FINDINGS  STATUS
  PersistenceScanModule                2  OK
  ScheduledTasksScanModule             1  OK
  TaskCacheScanModule                  1  PartialSuccess
  PrefetchScanModule                   4  OK

  [Persistence] HKLM\...\Run\NvBackend
      -> C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (missing)

  [Ghost Task] TaskCache\Tree entry with no COM counterpart (T1053.005)
      \NvProfileUpdaterOnLogon_{...}

  TaskCacheScanModule: PartialSuccess. 2 keys unreadable (access denied).

Run it in automation

GhostTrace.CLI scan --name nvidia --quiet --output C:\Cases\Host1

--quiet creates a non-interactive TXT record. A report write failure returns a non-zero exit code, so automation does not silently succeed without an artifact.

Essential commands

Goal	Command
Open the interactive menu	GhostTrace.CLI
Run a full triage	GhostTrace.CLI scan
Hunt a named application	GhostTrace.CLI scan --name <n>
Write a script-friendly scan record	GhostTrace.CLI scan --name <n> --quiet --output <directory>
Correlate Task Scheduler COM and TaskCache	GhostTrace.CLI scan-tasks-correlate-json --output <report.json>
Inspect a directory, Registry key, or Event Log	scan-fs-json, scan-reg-json, scan-evt-json

Choose the interface language with --lang:

GhostTrace.CLI scan --name nvidia --lang en
GhostTrace.CLI --lang pt-BR

Exit codes

Code	Meaning
0	Scan completed and any requested report was written
1	Invalid arguments or unsupported environment
2	Report write failure
3	Cancelled by the operator

From collection to review

1. GhostTrace runs the modules available for the selected collection.
2. Each module returns its own findings, errors, and metadata.
3. The CLI renders a concise summary and writes a local record when requested.
4. Any selected cleanup operation is written to a separate audit log.

What it collects

Area	Evidence sources
Persistence	Run/RunOnce, Startup, services, Winlogon, IFEO, AppInit, LSA, Active Setup, WMI, and scheduled tasks
Execution	Prefetch, Shimcache, BAM/DAM, UserAssist, and MUICache
User activity	PowerShell history, outbound RDP history, RecentDocs, USB, and network artifacts
Installed software and leftovers	Uninstall entries, StartupApproved, Program Files, ProgramData, and AppData traces
Scheduled task correlation	COM and TaskCache discrepancies used to investigate Ghost Tasks (T1053.005)

Module reference (internal collector names)

Persistence

Module	Source
PersistenceScanModule	Run/RunOnce and Startup folders
ServicesScanModule	Service and driver ImagePath values
AsepScanModule	Winlogon, IFEO, AppInit, LSA, and Active Setup
ScheduledTasksScanModule	Task Scheduler COM, including hidden tasks
TaskCacheScanModule	TaskCache\Tree anomalies
WmiPersistenceScanModule	__EventFilter, __EventConsumer, and bindings

Execution and activity

Module	Source
PrefetchScanModule	Windows 10/11 .pf files, including XPRESS-Huffman compression
ShimcacheScanModule	AppCompatCache
BamScanModule	BAM/DAM records by SID
UserAssistScanModule	GUI launches and usage counts
MuiCacheScanModule	Shell MUICache
PowerShellHistoryScanModule	PSReadLine history and suspicious command signals
RdpConnectionScanModule	Outbound RDP connection history
RecentDocsScanModule	Explorer RecentDocs
UsbDeviceScanModule	USBSTOR history
NetworkArtifactsScanModule	Hosts file and known network profiles

Forensic safety

GhostTrace is a read-only collector by default. Its cleanup workflow targets software leftovers, not automatic malware remediation.

• No network calls, telemetry, evidence upload, or cloud account is required.
• Cleanup starts with no preselected item and requires explicit selection plus typed confirmation.
• Execution caches and activity histories are never cleanup candidates.
• A directory is removable only when it is directly under a trusted root, exactly matches the target name, and is not a junction or symlink.
• Partial name matches become FilesystemTraceHint: reportable, never removable.
• JSON reports are written atomically, preserving an existing report until a replacement completes.
• Ctrl+C cooperatively cancels scheduled-task correlation and Prefetch file reading.

A finding is evidence, not a verdict. Interpret it with the host timeline, your environment, and your incident-response process.

What GhostTrace is not

• Not an antivirus and not a malware remediation tool.
• Not a memory forensics tool. It reads disk and Registry artifacts only.
• Not a remote collector. It inspects the local host.
• Not a verdict engine. It reports evidence for an analyst to interpret.

Outputs that fit the investigation

Output	Best for
Interactive table	Fast analyst review
TXT report	Local record from scan, including --quiet automation
JSON report	Directed collectors and scheduled-task correlation
Cleanup log	Auditing removed, skipped, and failed cleanup actions

PartialSuccess means a module produced findings but also encountered a limitation. Read that module's errors before treating an absent result as a clean source.

Built to be trusted

• Pull requests restore, build, and test on Windows with .NET 10.
• The release gate tests the full GhostTrace.sln before building the MSI.
• Both src/GhostTrace.Tests and tests/GhostTrace.Tests.Unit are included in the solution and CI.
• Stable releases accept only v<major>.<minor>.<patch> tags.
• GhostTrace is released under the MIT License.

Uninstall

Remove GhostTrace through Settings > Apps > Installed apps, or from an elevated prompt:

msiexec /x GhostTrace-1.5.0-x64.msi /qn

Reports and cleanup logs written to your output directory are not removed by the uninstaller. Delete them manually when the case is closed.

Documentation

• Scheduled Tasks Correlation Playbook
• Product roadmap
• UX and architecture decisions
• Test project guide
• README in Portuguese (Brazil)

Contributing

Contributions are welcome. Keep collectors read-only, propagate CancellationToken, surface coverage gaps as result errors, and include tests with behavior changes. The roadmap highlights the next high-impact areas.

---

GhostTrace supports investigation. Validate every artifact in the context of the host, its timeline, and your operating procedures.