The subject uninstalls software, which may also remove relevant artifacts from the system's disk, such as regsitry keys or files necessary for the software to run, preventing them from being used by investigators to track activity.

In some cases it is possible to identify software that has been uninstalled by reviewing two specific Event IDs within the Windows Logs > Application log relating to the Windows installer service. Event ID 11724: This event is logged when a software product is uninstalled. The event provides information about the product name, the version, and the user who initiated the uninstallation. Event ID 1034: This event is generated by the Windows Installer service and indicates that an application has been uninstalled. It provides details about the product name and the success or failure of the uninstallation process.