hiberfil.sys
pagefile.sys
swapfile.sys
System Volume Information
$Recycle.Bin\*
excludethis
Recycler
Recycled
Windows\CSC
winpepge.sys
$windows.~ls
$windows.~bt
Recovery.txt
bootsect.bak
ProgramData\Microsoft\Diagnosis\ETLLogs\*
ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\*
ProgramData\Microsoft\Diagnosis\EventStore.db
ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*
ProgramData\Microsoft\Network\Downloader\*
ProgramData\Microsoft\Search\Data\ApplicationsWindows\edb*
ProgramData\Microsoft\Search\Data\ApplicationsWindows\Windows.*
ProgramData\Microsoft\SmsRouter\MessageStore\edb*
ProgramData\MicrosoftWindows\SQM
ProgramData\MicrosoftWindows\WER\ReportArchive\*
ProgramData\Microsoft\Windows Defender\Support\*
ProgramData\Microsoft\Windows Security Health\Logs\*
ProgramData\MicrosoftWindows\wfp\*.etl
ProgramData\USOShared\Logs\*
Users\*\NTUSER.DAT*.TM.blf
Users\*\NTUSER.DAT*.regtrans-ms
Users\*\NTUSER.DAT*.log*
Users\*\AppData\Local\Microsoft\CLR_v4.0_64\UsageLogs\*
Users\*\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\*
Users\*\AppData\Local\Microsoft\Feeds\*
Users\*\AppData\Local\Microsoft\Feeds Cache\*
Users\*\AppData\Local\Microsoft\Internet Explorer\*.log
Users\*\AppData\Local\Microsoft\Internet Explorer\*.txt
Users\*\AppData\Local\MicrosoftWindows\Explorer\*
Users\*\AppData\Local\MicrosoftWindows\Explorer\*.etl
Users\*\AppData\Local\MicrosoftWindows\INetCache\IE\*
Users\*\AppData\Local\MicrosoftWindows\Media Player\*
Users\*\AppData\Local\MicrosoftWindows\WebCache\*
Users\*\AppData\Local\Microsoft\Terminal Server Client\Cache\*
Users\*\AppData\Local\Temp\*
Users\*\AppData\Local\Icon*
Windows\AppCompat\Programs\Amcache.hve*.TM.blf
Windows\AppCompat\Programs\Amcache.hve*.regtrans-ms
Windows\AppCompat\Programs\Amcache.hve*.log*
Windows\Debug\*
Windows\inf\*.etl
Windows\inf\*.ev*
Windows\inf\*.log
Windows\Logs\CBS\*
Windows\Logs\DISM
Windows\Logs\DPX
Windows\Logs\dosvc\*
Windows\Logs\NetSetup
Windows\Logs\waasmedic\*
Windows\Logs\WindowsUpdate\*
Windows\Logs\PBR
Windows\Logs\*.log
Windows\Microsoft.NET\Framework\v2.0.50727\*.log
Windows\Microsoft.NET\Framework\v4.0.30319\*.log
Windows\Microsoft.NET\Framework64\v2.0.50727\*.log
Windows\Microsoft.NET\Framework64\v4.0.30319\*.log
Windows\Panther\*.etl
Windows\Panther\*.log
Windows\Panther\FastCleanup
Windows\Panther\img
Windows\Panther\Licenses
Windows\Panther\MigLog*.xml
Windows\Panther\Resources
Windows\Panther\Rollback
Windows\Panther\Setup*
Windows\Panther\UnattendGC
Windows\Panther\upgradematrix
Windows\Prefetch\*
Windows\security\database\*.chk
Windows\security\database\*.log
Windows\security\database\*.jrs
Windows\security\logs\*
Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\*
Windows\ServiceProfiles\LocalService\NTUSER.DAT*.TM.blf
Windows\ServiceProfiles\LocalService\NTUSER.DAT*.regtrans-ms
Windows\ServiceProfiles\LocalService\NTUSER.DAT*.log*
Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.TM.blf
Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.regtrans-ms
Windows\ServiceProfiles\NetworkService\NTUSER.DAT*.log*
Windows\servicing\Packages\wuindex.xml
Windows\servicing\Sessions\*_*.xml
Windows\servicing\Sessions\Sessions.back.xml
Windows\SoftwareDistribution
Windows\System32\catroot2\*.txt
Windows\System32\catroot2\*.chk
Windows\System32\catroot2\*.log
Windows\System32\catroot2\*.jrs
Windows\System32\config\*.TM.blf
Windows\System32\config\*.regtrans-ms
Windows\System32\config\*.log*
Windows\System32\config\*.SAV
Windows\System32\config\*.reg
Windows\System32\config\RegBack\*
Windows\System32\config\systemprofile\*.TM.blf
Windows\System32\config\systemprofile\*.regtrans-ms
Windows\System32\config\systemprofile\*.log*
Windows\System32\config\TxR\*.blf
Windows\System32\config\TxR\*.regtrans-ms
Windows\System32\CodeIntegrity\bootcat.cache
Windows\System32\LogFiles\AIT\*
Windows\System32\LogFiles\Scm\*
Windows\System32\LogFiles\SQM\*
Windows\System32\LogFiles\WMI\*.etl*
Windows\System32\LogFiles\WMI\RtBackup\*.etl
Windows\System32\SleepStudy\*.etl
Windows\System32\SleepStudy\ScreenOn\*.etl
Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.TM.blf
Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.regtrans-ms
Windows\System32\SMI\Store\Machine\SCHEMA.DAT*.log*
Windows\System32\sru\*.txt
Windows\System32\sru\*.chk
Windows\System32\sru\*.log
Windows\System32\sru\*.jrs
Windows\System32\Sysprep\Panther
Windows\System32\Sysprep\Sysprep_succeeded.tag
Windows\System32\wdi\LogFiles\*
Windows\System32\wfp\*.etl
Windows\System32\winevt\Logs\*
Windows\System32\winevt\TraceFormat\*
Windows\Temp\*
Windows\WinSxS\Backup
Windows\WinSxS\ManifestCache\*
Windows\WinSxS\Temp\*
Windows\*.log
Windows.old
