How to find a cheat that was deleted before the check

The usual answer to a check request is a few minutes of silence while the player deletes things. It feels like it works. It rarely does, because Windows keeps records of what happened that have nothing to do with the files themselves.

The idea in one sentence

Deleting a file removes the file. It does not remove the record that the file was downloaded, unpacked, opened and run - and those records live in places a player rarely thinks about.

Records of programs that ran

• Prefetch - Windows keeps a small file for most programs it runs, with the last run times.
• Amcache - an inventory of executed programs that often keeps a fingerprint (hash) of the file. A renamed loader can still be recognised by that fingerprint after it is gone.
• BAM and UserAssist - records of programs started by each user, with times.
• ShimCache - a compatibility record that lists programs Windows has seen.

Records of files that are gone

• The NTFS journal - the file system logs deletions and renames, so a burst of deleted files right before a check is visible.
• The Recycle Bin - keeps the original path and the time of deletion, and often the file itself.
• Antivirus history - Windows Defender often catches loaders and keeps its record after the file is removed.

Folders and files that were opened

Explorer remembers folders that were opened (ShellBags), and Windows keeps lists of recently opened files and shortcuts (Recent items and Jump Lists). A folder named after a cheat that no longer exists can still show up there.

Downloads and browsing

Browser history and download history show visits to cheat shops and the files downloaded from them - including files that are no longer on the disk. History can be cleared, but an empty history on a profile that has been used for months is a sign of its own.

Signs that someone cleaned up

Cleaning leaves traces of its own. Look for:

• Event logs that were cleared, or a deletion journal that was reset
• An almost empty Prefetch folder on a system that has been in use for a long time
• Browser history that starts today on an old profile
• Cleaner tools that ran shortly before the check
• A brand-new Windows account, or Windows reinstalled just before the check

What it means for your decision

A trace of a cheat that ran is evidence even when the file is gone - the record shows that it was there, and when. Signs of cleaning are not proof of cheating on their own, but cleaning right before a check is hard to explain. Weigh both, check the dates, and write down what you decided.