Defender Trace Files

Why clean Defender Trace Files?

• Trace files left behind after Defender platform or security intelligence updates can reference old scan state, and users may notice repeated rescanning of the same files with brief CPU spikes during idle time
• An oversized RtSigs folder increases disk churn during scheduled scans, which shows up as slower scan completion and more sustained disk activity in Task Manager
• Corrupted trace artifacts can force Defender to discard cached scan context, leading to scan history inconsistencies and first-scan slowdowns while metadata is rebuilt
• Stale real-time scan traces may keep pointing to files that no longer exist, and users can see repeated protection events or log entries for paths that have already been removed
• On systems with limited free space, accumulated Defender trace data under ProgramData can consume hundreds of megabytes and contribute to low-disk-space warnings even though no user files were added
• Old scan metadata can make troubleshooting harder because current detections are mixed with obsolete trace records, so clearing them helps when users see recurring alerts that do not match present files
• If Defender stores trace data in SQLite-backed metadata files, page fragmentation can waste space and slow lookups; VACUUM rewrites the database pages compactly without deleting actual rows, while cleaning removes obsolete trace artifacts rather than user data

Common questions about Defender Trace Files

Download Kudu and reclaim your disk space.

Available on Windows, macOS, and Linux. No account required, no feature gates, no telemetry without consent. All cleaning targets are open source and community-auditable.