Documentation

Everything you need to know about Clubhouse AC - the most comprehensive forensic anti-cheat scanner available.

2,600+
Detection Methods
45
Detection Categories
100%
Read-Only Scan
<60s
Scan Time

What We Detect

Our scanner performs over 2,600+ forensic checks across 45 detection categories.

FiveM Bypass Detection120

Comprehensive FiveM cheat and bypass detection across multiple forensic artifact sources

Security Evasion Detection85

Detects deliberate disabling or tampering with Windows security features used by bypasses

Cheat Signature Detection200

Named cheat and bypass signature database — continuously updated with new threats

Memory Forensics151

Deep memory analysis including process injection, hook detection, and kernel-level forensics

File System Forensics118

NTFS forensics, disk artifact analysis, and deleted file recovery techniques

Execution Artifacts114

Complete execution history analysis across all Windows artifact sources

Cleaner Tool Detection110

Detection of evidence destruction tools and cleanup utilities

Registry Forensics107

Deep Windows registry analysis and artifact recovery

HWID Spoofer Detection100

Hardware ID spoofing and manipulation detection across all system identifiers

Anti-Forensics Detection100

Detection of evidence hiding, tampering, and anti-forensic techniques

Behavioral Analysis71

Pattern recognition and anomaly detection across system activity

Kernel/Driver Forensics62

Kernel-level analysis including driver integrity and rootkit detection

Browser Forensics61

Comprehensive browser artifact analysis for cheat-related activity

DMA Hardware Detection60

Hardware-based cheat device detection and analysis

Hardware Integrity60

Hardware configuration verification and tampering detection

Memory/Process Analysis60

Process memory forensics and code injection detection

Firmware/UEFI Analysis60

Low-level firmware analysis and bootkit detection

Timestamp Analysis50

Temporal correlation and timestamp manipulation detection

Evidence Correlation50

Cross-artifact correlation engine for high-confidence verdicts

Reporting & Evidence50

Evidence collection, validation, and report generation

Network Forensics42

Network connection analysis and cheat communication detection

Fuser/Capture Detection40

Display capture and fusion device detection

Virtualization Detection37

Virtual machine, sandbox, and hypervisor detection

Peripheral Forensics20

USB device history and peripheral device analysis

Fileless Bypass Detection50

Detect memory-only cheats and evasion techniques that leave no files on disk

Gaming Platform Analysis30

Game client forensics — cache integrity, plugin detection, and mod analysis

Cloud Sync Forensics7

Cloud storage forensics for remotely stored or synced cheat files

PC Swap Detection100

Detect when users run scans on secondary or clean PCs instead of their main system

LSASS Credential Abuse45

Detection of credential dumping tools and protection bypass techniques

Jump List Forensics30

Windows Jump List analysis for application usage history

LNK File Analysis25

Windows shortcut analysis — LNK files preserve forensic evidence of deleted executables

Amcache Forensics35

Amcache analysis that preserves evidence of deleted programs

SRUM Database Analysis30

System Resource Usage Monitor analysis — tracks application resource usage

Windows Timeline20

ActivitiesCache analysis for cross-session application usage tracking

Recycle Bin Forensics25

Deleted file metadata and content recovery from the Recycle Bin

NTFS Index Analysis20

NTFS directory index analysis for recovering deleted file evidence

Deep Event Log Analysis45

Comprehensive event log parsing for security-relevant system events

AppCompatFlags / PCA25

Program Compatibility Assistant artifact analysis

Prefetch Deep Analysis30

Deep prefetch analysis for execution history and anomaly detection

Registry Deep Analysis35

Advanced registry analysis including deleted key recovery and history tracking

ShellBags Deep Analysis25

ShellBag parsing for folder access evidence and browsing history

Binary String Extraction25

Binary string extraction for identifying suspicious executables and embedded data

Volume Shadow Copy Analysis25

Volume shadow copy analysis to recover deleted files and historical system states

Registry Transaction Logs25

Registry transaction log analysis for recovering deleted or modified registry operations

Uncleaned Trace Analysis75

Detects forensic artifacts that cheats and cleaners cannot remove

2,600+ Detection Methods

Continuously updated with new detection signatures. Our forensic engine leaves no trace unexamined.

Persistent Evidence Cheaters Cannot Fully Clear

Clubhouse AC is built around artifacts that survive deletion attempts, partial cleanup, hardware spoofing, and memory-only execution. Every playbook below documents the artifact source, how we analyze it, and the anti-cheat evasion technique it is designed to defeat.

Registry remnants & cleaner residue
Location / source
BAM, UserAssist, MuiCache, AppCompatFlags, Services, Enum\PCI, adapter history
Detection logic
Correlates orphaned keys, stale hardware classes, recently modified hives, and deleted executable paths that remain after selective cleanup.
Prevents evasion
Registry cleaning, HWID spoofer cleanup, service removal, and post-match evidence scrubbing.
NTFS timeline residue
Location / source
$MFT, USN Journal, $LogFile, directory indexes, Recycle Bin metadata
Detection logic
Recovers deleted file names, rename chains, and execution-adjacent create/delete activity even when the cheat binary is no longer present.
Prevents evasion
File deletion, rename cycling, secure-delete attempts, and 'clean folder' claims after cheat use.
Execution history that survives cleaning
Location / source
Prefetch, ShimCache, Amcache, Jump Lists, LNK files, SRUM, Windows Timeline
Detection logic
Validates execution counts, launch order, and referenced modules across independent sources to prove a tool ran even after files are gone.
Prevents evasion
Prefetch wiping, cache clearing, renamed loaders, and partial execution history cleanup.
Memory hooks & memory-only cheats
Location / source
Live process memory, module lists, thread start addresses, page protections, hollowed processes
Detection logic
Flags DLL injection, reflective loads, code caves, RWX shellcode, manual mapping, and image-to-memory mismatches.
Prevents evasion
Fileless bypasses, manual-map loaders, hollow processes, and cheats designed to live only in RAM.
Kernel tampering & unsigned driver injection
Location / source
Loaded/unloaded driver lists, service creation events, Kernel-PnP logs, vulnerable driver traces, callback tables
Detection logic
Cross-checks kernel telemetry, driver metadata, and load history for unsigned drivers, BYOVD chains, and integrity bypass residue.
Prevents evasion
Kernel bypasses, driver unloading, vulnerable-driver abuse, and hidden ring-0 cheat deployment.
Anti-forensic tool traces
Location / source
Cleaner install paths, AppCompat entries, event logs, shadow copy state, transaction logs
Detection logic
Looks for cleaner execution, event log clearing, shadow copy deletion, transaction-log gaps, and known anti-forensic tool footprints.
Prevents evasion
CCleaner/PrivaZer/BleachBit usage, log tampering, artifact purges, and recovery-surface destruction.
Timestamp & log tampering
Location / source
MACB timestamps, $SI/$FN pairs, Prefetch folder times, Event ID 104/1102, WER and service timelines
Detection logic
Detects timestomping, impossible timestamp order, and audit gaps where normal system activity should exist but does not.
Prevents evasion
Timestomp utilities, altered file metadata, cleared security logs, and manipulated incident timelines.
Behavioral anomaly correlation
Location / source
Cross-artifact timelines spanning launchers, services, drivers, scripts, and system activity
Detection logic
Builds a single timeline to catch suspicious gaps, loaders executing immediately before the game, or device activity inconsistent with claimed behavior.
Prevents evasion
False alibis, delayed cleanup, timeline fragmentation, and 'nothing ran during the session' claims.
Hardware, firmware & DMA inconsistencies
Location / source
Disk serials, MAC/OUI history, SMBIOS, GPU/PCIe inventory, TPM state, UEFI/Secure Boot telemetry, SetupAPI logs
Detection logic
Verifies that hardware identifiers agree across firmware, registry history, and device-install logs while checking for DMA and firmware tampering residue.
Prevents evasion
HWID spoofers, MAC changers, GPU/SMBIOS spoofing, PCIe DMA devices, and firmware-level concealment.
PC swap & platform artifact verification
Location / source
Wi-Fi profiles, ARP cache, adapter history, Steam/Epic/Fortnite/Roblox manifests, cloud sync metadata
Detection logic
Checks whether the scanned machine matches the player’s normal network and launcher history, then verifies game-client artifacts against expected install activity.
Prevents evasion
Scanning a clean secondary PC, swapping adapters, using borrowed systems, and hiding behind freshly installed game clients.

Game-Tailored Forensic Coverage

We do not rely on one generic ruleset. Each title reuses the same durable Windows evidence sources, then layers game-specific launcher, cache, module, and behavioral validation on top.

FiveM
Primary focus

CitizenFX cache integrity, Lua executors, resource injectors, loaders and driver activity near launch

Key artifacts

Citizen cache, Prefetch, BAM/UserAssist, PcaSvc, DPS, service and driver timelines

Rust
Primary focus

BYOVD chains, DMA prep tools, external loaders, no-recoil scripts, Easy Anti-Cheat bypass residue

Key artifacts

Driver traces, FPGA tooling, Prefetch, AppData loader paths, startup and service remnants

R6S
Primary focus

BattlEye bypass loaders, ring-0 cheat traces, unsigned drivers and external overlay artifacts

Key artifacts

Kernel load history, service creation, crash data, launcher and execution history

Fortnite
Primary focus

Epic launcher integrity, external cheat residue, injected modules, WER crash and overlay artifacts

Key artifacts

Epic manifests, Fortnite logs, WER/AppCrash data, Prefetch, driver and module timelines

Minecraft
Primary focus

Ghost clients, jar-based cheats, launcher profile edits, macro/autoclick tooling and modded runtimes

Key artifacts

Launcher profiles, mod folders, Java execution history, logs, Prefetch, recent file traces

Roblox
Primary focus

Executor residue, injected DLL traces, cache anomalies and suspicious tooling around Roblox sessions

Key artifacts

Roblox logs/cache, AppData traces, Prefetch, browser download history, memory injection residue

Valorant
Primary focus

Kernel tampering, TPM/Secure Boot inconsistencies, Vanguard conflict traces and hardware spoofing

Key artifacts

Driver/service telemetry, TPM state, Secure Boot data, hardware history, launcher timelines

CS:GO / CS2
Primary focus

External overlays, injector residue, Steam integrity checks, launch-option abuse and DLL injection

Key artifacts

Steam manifests, game config history, Prefetch, module lists, browser/download artifacts

Tarkov
Primary focus

DMA setup, vulnerable-driver abuse, launcher tampering and radar/overlay support tooling

Key artifacts

PCIe inventory, SetupAPI logs, launcher traces, memory artifacts, network and driver history

How to Use

Getting started is straightforward. Here's the process from start to finish.

1

Get your scanner link

After purchasing, you'll receive a unique download link for your server's scanner. This links all scans back to your dashboard.

2

Send to suspect

When you suspect a player, DM them the scanner link. The scanner is a small executable that runs without admin rights.

3

Player runs scan

The player downloads and runs the scanner. It takes 30-60 seconds and automatically uploads results to your dashboard.

4

Review results

Check your dashboard for the scan results. Click on any scan to see detailed findings, file paths, timestamps, and severity levels.

5

Take action

Based on the findings, decide whether to clear the player or take action. Export reports for ban appeals or evidence.

Frequently Asked Questions

Common questions from server owners and staff.

Is the scanner safe for players to run?

Yes. The scanner is 100% read-only and doesn't modify any files on the player's system. It performs forensic analysis of system artifacts and securely uploads results to your dashboard.

How comprehensive is the detection coverage?

Our scanner performs 2,600+ forensic checks across 45 detection categories, with additional artifact-driven playbooks covering persistent evidence, memory-only cheats, anti-forensics, kernel tampering, hardware integrity, and game-specific validation. It's the most comprehensive anti-cheat scanner available.

Can cheaters bypass the scan?

We have extensive detections for cleaner tools, anti-forensics techniques, dedicated FiveM bypass correlation, security evasion detection, and advanced recovery that finds traces even after deletion attempts. Cleanup attempts themselves leave evidence we can detect.

How long does a scan take?

Most scans complete in 30-60 seconds. Our scanner is optimized for speed while performing deep forensic analysis across all 45 detection categories.

What about DMA/hardware cheats?

Yes, we detect DMA and FPGA-based cheat hardware. We have dedicated hardware detection checks plus fuser/capture device detections. Hardware cheats are not invisible to forensic analysis.

What if a detection is wrong?

We maintain a very low false positive rate through forensic validation. Each detection includes full context - file paths, timestamps, and severity levels - so you can verify findings.

Do you detect HWID spoofers?

Yes. We have extensive HWID spoofer detection checks that cross-validate multiple hardware data sources to detect inconsistencies. Spoofing always leaves traces.

How often are detections updated?

Our detection signatures are continuously updated to cover new cheats, bypasses, and evasion techniques. The current database includes thousands of detection methods across our 45 documented detection categories, and we separately keep expanding the artifact-driven playbooks used to explain how those detections work.

Is detection coverage tailored per game?

Yes. We combine shared Windows forensic traces with game-specific artifact validation for FiveM, Rust, R6S, Fortnite, Minecraft, Roblox, Valorant, CS:GO/CS2, and Tarkov so detections match how each ecosystem is actually abused.

Do you have access to my Supabase if I added it?

No. We do not get direct access to your Supabase account. Adding an MCP server configuration on your side does not grant us access by itself. Clubhouse AC only connects using the Supabase URL and keys configured in your own deployment environment.

Ready to protect your server?

Get access to 2,600+ forensic detection methods across 45 categories. The most comprehensive anti-cheat scanner available.

Get Started