Supported evidence.Visible limitations.

Execution traces and referenced paths

Available when Windows Prefetch is enabled and readable.

Combines process-creation events, Prefetch hints, and registry context with path and available signer status

Registry traces are not execution proof; signatures are only shown when checked. Missing paths do not prove deletion.

File creation, deletion, rename, and change context

Journal retention and administrator access affect depth.

Groups bounded USN changes and computes observed create-to-delete intervals

Both timestamps must be present; observed interval is not necessarily a file's total lifetime.

Historical folder interaction and removed locations

Timestamps and paths are context, not proof by themselves.

Uninstall entries plus UserAssist, BAM, and Compatibility Assistant context

Keys may be unavailable; presence alone does not prove execution or cheating.

USB hardware model, device class, and current device status

Device serials are omitted; this does not establish connection times or file transfers.

Download hosts and file names from a bounded read of selected running applications

Requires separate consent. Sensitive/system processes are excluded; raw memory and full URLs are not saved.

Opt-in bounded command history from readable user profiles

Individual PSReadLine commands lack timestamps; private text may remain despite common-secret redaction.

Links browser download metadata, a file's download-origin marker, exact path or hash execution evidence, and Roblox timing

Only shown when independent artifacts match; an absent marker or same filename alone proves nothing.

Sysmon Roblox DLL and suspicious driver loads, plus relevant Code Integrity warnings

Requires those Windows logs to exist; a load or block event alone is not a cheat verdict.

Security and System log-clear events shown on the forensic timeline

A cleared log has many possible causes and does not prove cheating.

Shows supporting sources, first-observed time, confidence, and alternative explanations

Reviewers still need to verify the underlying evidence before deciding.

Dangerous handles and remote-thread activity targeting Roblox

Requires Sysmon with relevant event IDs configured.

Memory, overlay/input, mapper, and driver-assisted indicators

Heuristics require multiple signals to reduce overlay false positives.

Accounts, games, places, launches, exits, flags, and session events

Deleted or rotated logs reduce historical reach.

Account and game reconstruction with timestamped nearby findings

Account identifiers are non-secret and source-dependent.

Joins independent artifacts into explainable confidence

Correlation strength depends on collector availability.

Recycle Bin, USN, Prefetch, and recovery metadata

Securo preserves metadata; it does not restore or modify files.

Client flags grouped with source logs and sessions

A flag is not automatically cheating; context determines classification.

Launch agents, login items, applications, and file artifacts

Full Disk Access may be needed for complete coverage.

Detailed collected evidence remains auditable in local reports

Reports reflect what collectors could access at scan time; raw application memory is not retained.