Tier 1Quick triage · 5–10 min · 37 methods
Foundation
PC checking (also called a screenshare or SS) is a forensic-style review of a computer to determine cheat usage. Tier 1 covers the standard artifact set every check should walk: where Windows leaves footprints of execution, persistence, file activity, and user behaviour — even after the cheat itself is gone.
T1
Info
2T1
Tool Downloads
3T1
Execution Artifacts
5T1
Logs & Events
2T1
File System
6T1
User Activity
4T1
Registry
1T1
Persistence & Services
3T1
Live System
4T1
Network & Devices
2T1
Advanced
4T1
Tools
1The Golden Rule — Tier 1
No single artifact tells the whole story. Cross-reference EVERYTHING. Timeline it. Correlate it. Trust the pattern.