Is there any way to map the A000????.??? filenames in the System Volume Information to their original names, without restoring them?

The reason I ask is that several files in one user's System Volume Information RP1 were infected by a rootkit. Although they've been removed, I'd like to be able to figure out what they were originally. A0001253.sys and A0001211.sys are not very helpful names. :)

It happened on two systems, one XP SP2, the other XP SP3.


See Restore Point Forensics, which describes restore points in depth.

In short, the renamed files are tracked in the "change.log" file. Search for the file name of interest (the original extension remains unchanged), and the original path is found before the renamed file-name :

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy