A Mystery Uncovered with evtSpike: Following Windows Event Noise to 402 GiB of Hive Copies
Repeated informational Event ID 16 messages, first seen in DrainCtl evtSpike, led to a read-only check of 49 Windows servers. It found 1,174 OESIS hive-copy directories holding about 402.66 GiB, with the evidence limits and unproven points stated plainly.