A subject uninstalls software, which may also remove relevant artifacts from the system's disk, such as registry keys or files associated with the software, potentially preventing investigators from using these artifacts to reconstruct activity.

In some cases it is possible to identify software that has been uninstalled by reviewing two specific Event IDs within the Windows Logs > Application log relating to the Windows installer service. Event ID 11724: This event is logged when a software product is uninstalled. The event provides information about the product name, the version, and the user who initiated the uninstallation. Event ID 1034: This event is generated by the Windows Installer service and indicates that an application has been uninstalled. It provides details about the product name and the success or failure of the uninstallation process.