O'Reilly logo

Mastering Windows Network Forensics and Investigation, 2nd Edition by Scott Pearson, Ryan Johnson, Steve Bunting, Steven Anson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Windows XP Restore Point Content

Now that we’ve covered all the details of restore point creation, let’s get to the good stuff, which is the content of restore points. In essence, an XP restore point makes copies of important system and program files that were added since the last restore point. These files, except for registry hive files, are stored in the root of the RP## folder; however, they are not easily recognized because their names have been changed. These files are renamed according to the following naming convention: A#######.ext, where the pound signs are random numbers and the file extension is the same as that of the original file.

Logic tells us that Windows must have a means of mapping these new filenames to the original filenames ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required