GhostTrace

Find what software left behind on Windows, before it finds its way back.

GhostTrace is a local Windows forensic trace hunter for incident responders, system administrators, and security-minded power users. It maps persistence, execution, activity, and leftover artifacts into a reviewable record, then offers tightly constrained cleanup only when you explicitly choose it.

Download | Quick start | Capabilities | Safety model | Roadmap | Portuguese (Brazil)

Why GhostTrace

Uninstalling an application does not always remove its operational footprint. Startup entries, scheduled tasks, cached execution evidence, registry values, services, and folders can remain long after the installer reports success.

GhostTrace turns that broad question into a focused, local investigation:

• One focused hunt across 22 forensic modules.
• Evidence by source, with findings, errors, and metadata kept per module.
• Offline by design, with no telemetry, uploads, or cloud dependency.
• Audit-ready output, including TXT records, JSON outputs for directed collectors, and cleanup logs.
• Human-controlled cleanup, never automatic remediation.

Quick start

Install

Download the latest x64 MSI from Releases:

GhostTrace-<version>-x64.msi

The package is self-contained, so the target machine does not need a pre-installed .NET runtime. Run GhostTrace as Administrator to access protected Windows artifacts.

Hunt a software name

GhostTrace.CLI scan --name nvidia

The interactive flow shows progress, groups findings by technique, and can export a record of the investigation. If safe cleanup candidates exist, you must select them and type a confirmation phrase before any removal occurs.

Run it in automation

GhostTrace.CLI scan --name nvidia --quiet --output C:\Cases\Host1

--quiet creates a non-interactive TXT record. A report write failure returns a non-zero exit code, so automation does not silently succeed without an artifact.

Essential commands

Choose the interface language with --lang:

GhostTrace.CLI scan --name nvidia --lang en
GhostTrace.CLI --lang pt-BR

From collection to review

1. GhostTrace runs the modules available for the selected collection.
2. Each module returns its own findings, errors, and metadata.
3. The CLI renders a concise summary and writes a local record when requested.
4. Any selected cleanup operation is written to a separate audit log.

What it collects

Persistence modules

Execution and activity modules

Forensic safety

GhostTrace is a read-only collector by default. Its cleanup workflow targets software leftovers, not automatic malware remediation.

• No network calls, telemetry, evidence upload, or cloud account is required.
• Cleanup starts with no preselected item and requires explicit selection plus typed confirmation.
• Execution caches and activity histories are never cleanup candidates.
• A directory is removable only when it is directly under a trusted root, exactly matches the target name, and is not a junction or symlink.
• Partial name matches become FilesystemTraceHint: reportable, never removable.
• JSON reports are written atomically, preserving an existing report until a replacement completes.
• Ctrl+C cooperatively cancels scheduled-task correlation and Prefetch file reading.

A finding is evidence, not a verdict. Interpret it with the host timeline, your environment, and your incident-response process.

Outputs that fit the investigation

PartialSuccess means a module produced findings but also encountered a limitation. Read that module's errors before treating an absent result as a clean source.

Built to be trusted

• Pull requests restore, build, and test on Windows with .NET 10.
• The release gate tests the full GhostTrace.sln before building the MSI.
• Both src/GhostTrace.Tests and tests/GhostTrace.Tests.Unit are included in the solution and CI.
• Stable releases accept only v<major>.<minor>.<patch> tags.
• GhostTrace is released under the MIT License.

Star history

Track the project's public star history on Star History.

Documentation

• Scheduled Tasks Correlation Playbook
• Product roadmap
• UX and architecture decisions
• Test project guide
• README in Portuguese (Brazil)

Contributing

Contributions are welcome. Keep collectors read-only, propagate CancellationToken, surface coverage gaps as result errors, and include tests with behavior changes. The roadmap highlights the next high-impact areas.

GhostTrace supports investigation. Validate every artifact in the context of the host, its timeline, and your operating procedures.