Screen share is over: a forensic scan in 30 seconds

For years the standard way to check a suspicious player was a screen share: hop in a voice channel, ask them to open a few folders, look at their task manager, and hope. It is slow, it is awkward for an innocent player, and anyone who has cheated for more than a week knows how to pass it. Cheats run from USB sticks, from renamed files, or are deleted five minutes before the call.

What a deleted cheat leaves behind

Windows keeps far more history than most people realise, much of it for performance and compatibility reasons. A program that ran on the computer usually leaves traces in several places at once:

• Prefetch — Windows records programs it has launched so it can start them faster next time, including when they last ran.
• BAM (Background Activity Moderator) — a per-user record of executables that ran recently, with timestamps.
• Amcache — information about programs that were present and executed on the system.
• The USN journal — the file system's own log of files being created, renamed and deleted.

Deleting a cheat removes the file. It does not remove these records, and the records agree with each other, which makes them hard to fake convincingly.

How a TruffScan check works

1. A staff member creates a PIN in the panel and sends the player a link.
2. The player downloads the scanner, enters the PIN and starts the scan. Nothing is installed.
3. In 15 to 30 seconds the scanner checks running processes, program traces, recent files and the browser history for known cheats and for the server's own custom search terms.
4. The findings and a desktop screenshot arrive in the staff panel, grouped by category, with paths and timestamps.

The scan looks for matches on the player's own computer and sends only what matched. It does not upload documents, photos or a full browsing history.

Reading a result fairly

A finding is a lead, not a verdict. A file named like a known cheat can be a harmless leftover, and a cleaning tool in Prefetch is not proof of anything by itself. Look at the whole picture: what ran, when it ran relative to the game, and whether the traces point the same way. When they do, you have something far more solid than "he looked nervous on the screen share".

And when a scan comes back clean, say so. Players who were checked and cleared are your best advocates for the process.