drop file listings · mft csv · registry exports · detect use of exiftool mat2 or similar metadata strippers · they leave their own traces · identify files that were processed by scrubbing tools · runs locally
artifacts
drop exports (multi-file)
or click
drop mft csv · file listings · registry .reg · prefetch csv