Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to map the A000????.??? filenames in the System Volume Information to their original names, without restoring them?

The reason I ask is that several files in one user's System Volume Information RP1 were infected by a rootkit. Although they've been removed, I'd like to be able to figure out what they were originally. A0001253.sys and A0001211.sys are not very helpful names. :)

It happened on two systems, one XP SP2, the other XP SP3.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

See Restore Point Forensics, which describes restore points in depth.

In short, the renamed files are tracked in the "change.log" file. Search for the file name of interest (the original extension remains unchanged), and the original path is found before the renamed file-name :

enter image description here

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.