Parity item. Detect devices removed by Win10's periodic device cleanup (records partially gone).
Blocker: analysis heuristic over registry + event-log state; needs a real corpus exhibiting the cleanup with documented ground truth to validate against (avoid a tier-3-only heuristic).
Parity item. Detect devices removed by Win10's periodic device cleanup (records partially gone).
Blocker: analysis heuristic over registry + event-log state; needs a real corpus exhibiting the cleanup with documented ground truth to validate against (avoid a tier-3-only heuristic).