Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.

  • From normal Windows logs? No.
    – schroeder
    Aug 28 at 8:11
  • @schroeder What about other ways? Aug 29 at 6:50
  • Sure, there are all kinds of endpoint software that could log when a file is opened.
    – schroeder
    Aug 29 at 8:08
  • But it's unlikely that any such software would be running in the PE environment, even if it is present on the installed Windows environment.
    – Ben Voigt
    Sep 1 at 14:38


You must log in to answer this question.

Browse other questions tagged .