drop registry export and powershell evtx csv · detect windows clipboard history disabled or cleared · identify clipboard clearing commands · surface loss of clipboard content evidence · runs locally
drop registry export and powershell evtx csv · local only
heuristic screener · vendor schema varies · not definitive proof