As an aside, even if it were not installed, the user could have run the portable version from a flash drive. What makes you think that the user ran CC? (Computer evidence, we don't want to know about the user.) Without the above info we don't know if CC is installed on the target image. Is there any registry entry at all for CC or Piriform? If CC is installed and if the user did run it, then maybe he or she used the default settings.

You imply that there's no registry entry for individual CC check boxes until the boxes are checked (something I didn't know). You searched for CCleaner on your target image and had no hits? Is CC installed on the target image? Do you have a c:/program files/ccleaner folder? I surely would be grateful for some registry paths that tell me (1) the location of the settings and (2) if the settings are still at the installation defaults. INI file, but I am working on a read-only forensic image and I need to find the setting without booting the system or making any changes. The HKEY_Local_Machine/Software/Microsoft/Windows/currentversion/uninistall/ccleaner shows the system was running CCleaner Version 2.29. Under XP / Vista it doesn't show up under that registry path and I can't find any other path where it does. For example, once I make a change to the 'wipe free space' check box I can see the 'Wipe Free Space' key get created the first time and then show up as True or False thereafter. On my Win2k system I can see the settings change in the registry under HKEY_Current_User/software/piriform/ccleaner. Just one thing I need to know:Where is the CCleaner 'wipe free space' setting stored? I have been all over the documentation and the other forum entries, maybe I missed it.

Ccleaner clean registry