Is it possible to detect/trace if a Windows Live/PE is used on a system? Like with logs or dumps etc.

  • From normal Windows logs? No.
    – schroeder
    Commented Aug 28, 2023 at 8:11
  • @schroeder What about other ways? Commented Aug 29, 2023 at 6:50
  • Sure, there are all kinds of endpoint software that could log when a file is opened.
    – schroeder
    Commented Aug 29, 2023 at 8:08
  • But it's unlikely that any such software would be running in the PE environment, even if it is present on the installed Windows environment.
    – Ben Voigt
    Commented Sep 1, 2023 at 14:38


You must log in to answer this question.

Browse other questions tagged .