Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to map the A000????.??? filenames in the System Volume Information to their original names, without restoring them?

The reason I ask is that several files in one user's System Volume Information RP1 were infected by a rootkit. Although they've been removed, I'd like to be able to figure out what they were originally. A0001253.sys and A0001211.sys are not very helpful names. :)

It happened on two systems, one XP SP2, the other XP SP3.

share|improve this question
up vote 3 down vote accepted

See Restore Point Forensics, which describes restore points in depth.

In short, the renamed files are tracked in the "change.log" file. Search for the file name of interest (the original extension remains unchanged), and the original path is found before the renamed file-name :

enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.