drop multiple evtx csvs · cross-channel sequence number analysis · detect record ID gaps across all loaded channels simultaneously · identify coordinated multi-channel deletion · surface which channels were targeted · runs locally
60s coordination matrix · 3+ channels = coordinated · Security+System+PowerShell = thorough wipe · missing channel inventory
drop evtx csv exports (any channel, multi-file)