Summary

This article explains what "Uninstall" evidence is and how it's detected.

Synopsis

Applications that have "Uninstall" evidence type are detected from the "Uninstall" registry keys under Windows (what populates "add/remove programs"), but they are not MSIs (applications installed by the other installer technologies than MSI).

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

"Uninstall" can indicate either it is installed or it has been removed (inappropriately) and the Windows registry key still remains in the system.