How to find what an uninstaller left behind

Why leftovers happen

An installer writes to more places than its uninstaller remembers. Program files, a configuration directory, a cache directory, application support, logs, a service registration, a scheduled task, a few registry keys, sometimes a driver.

The uninstaller is generally written from a list of what the installer put down, and that list drifts. Files created by the program while it ran — caches, logs, indexes, downloaded updates, user settings — are usually not on it at all, quite deliberately, because a lot of people uninstall in order to reinstall and would be annoyed to lose their settings.

So leftovers are normal. The question is only whether they matter, and how to find them.

The usual approach and its ceiling

Most cleanup tools carry a list of patterns: known vendor folder names, known cache locations, known registry paths. That works for popular software and is entirely blind to anything nobody thought to add — which, if you install a lot of small utilities, is most of what you install.

It is also the approach with the highest risk of a false positive, because a pattern like “any folder in Application Support whose name matches a program that is not installed” will eventually match something you needed.

The approach that actually finds everything

Compare the disk against itself.

1. Take a snapshot before you install: the path, size and modification time of every file under the roots you care about.
2. Install, use, and later uninstall the program.
3. Take a second snapshot.
4. Diff them.

Whatever is in the second and not the first, restricted to the places the program touched, is exactly what it left behind. There is no pattern list, no vendor database, and no question of whether the tool has heard of the program you are removing.

The cost is that you have to have thought of it in advance. Which makes it a habit worth having if you evaluate software regularly — take one snapshot of your home directory now, and every future uninstall is answerable.

Doing it right now, without a snapshot

If the program is already gone, you are back to looking. In rough order of how much room they occupy:

• macOS: ~/Library/Application Support/, ~/Library/Caches/, ~/Library/Preferences/, ~/Library/Logs/, ~/Library/Containers/, and /Library/ for the machine-wide equivalents.
• Windows: %APPDATA%, %LOCALAPPDATA%, %PROGRAMDATA%, and leftover directories in Program Files and Program Files (x86).

Sort each by size, look for the name of the thing you removed, and move rather than delete what you find. A folder in a holding area for a fortnight costs nothing; a folder deleted because it looked orphaned and was not is an afternoon.

Is it worth doing at all?

Honestly: for one program, usually not. A few megabytes of settings is not a problem worth an hour.

It becomes worth doing when:

• You install and remove software often — leftovers accumulate and are almost entirely dead weight after a while.
• Something is misbehaving on reinstall. Stale configuration surviving an uninstall is one of the most common reasons “I reinstalled it and it still does the same thing”.
• You are handing a machine to somebody else and want it genuinely clean.
• You look after a lot of machines and want to know where the reclaimable space is before you buy anything.

The programs for this

• AppSweep is the snapshot-diff one. snapshot records the path, size and modification time of every file under the roots you name; diff reports what was added, removed and changed between two snapshots. It finds orphans nobody wrote a pattern for, because it is not using patterns.
• AppJanitor is the immediate one: walk a tree and report the .tmp, .bak, Thumbs.db and older-than-you-said files quietly piling up in it. scan is read-only; clean moves matches into a quarantine folder and is a dry run unless you pass --apply.
• CleanInstall is the same job driven by a written policy, with an append-only ledger recording every file it ever moved — for when you need to be able to show somebody what was cleared and when.
• FreshDesk surveys a fleet and tells you which machine has the most reclaimable space and in which category.

Free while we are in preview, one file each, Windows and Mac.

One warning about registry cleaners

Leftover registry keys on Windows are, with rare exceptions, harmless. They occupy a trivial amount of space and are never read, because nothing is looking for them. Tools that promise a speed improvement from removing them are promising something that has not been measurable for about twenty years, and the downside — a removed key that something did need — is real. Clean up the files. Leave the registry alone unless you have a specific reason.