MANDIANT Restore Point Analyzer
A simple forensic tool to analyze change.log files from restore points to determine the original paths and file names of files stored inside restore points.
Learn more about Restore Point Analyzer
White Paper
Forensic Analysis of System Restore Points in Windows XP