CyberCode Academy

Course 36 - Windows Forensics and Tools | Episode 9: Uncovering Hidden Evidence

Listen Later
In this lesson, you’ll learn about: Windows System Restore Points in digital forensics1. What Are System Restore Points?
  • A Windows feature that creates snapshots of system state
  • Designed for recovery after:
    • System failures
    • Bad updates
    • Software issues
🔹 Key Idea
  • They act as a historical snapshot of system behavior
2. Why They Matter in Forensics
  • Restore points preserve evidence that may be:
    • Deleted
    • Wiped
    • Modified
🔹 Forensic Value
  • Helps reconstruct:
    • System changes
    • Malware introduction
    • Configuration modifications
3. What Is Stored in Restore Points
  • Registry snapshots
  • Selected system files
  • Configuration data
  • Logs and application traces
👉 Important Insight:
  • They preserve system state, not just individual files
4. Metadata Preservation🔹 Key Concept
  • Restore points preserve MAC times:
    • Modified
    • Accessed
    • Created
🔹 Why it matters
  • Enables accurate timeline reconstruction
  • Helps detect tampering or backdating attempts
5. Trigger Events for Restore Points🔹 When Windows creates them
  • Software installation
  • System updates
  • Every ~24 hours of uptime
  • Manual user trigger
👉 Key Insight:
  • Restore points are often created during high system activity periods
6. Internal Structure of Restore Points🔹 Storage Location
  • Hidden directory:
C:\System Volume Information 🔹 Folder Structure
  • Stored as sequential folders:
    • RP1
    • RP2
    • RP3
    • etc.
7. File Tracking Mechanism🔹 Key Component
  • filelist.xml
🔹 Purpose
  • Defines:
    • Which file types are monitored
    • Which directories are included
👉 Key Insight:
  • Acts as a control map for snapshot creation
8. Change Tracking System🔹 Important File
  • change.log
🔹 Function
  • Records:
    • Original filenames
    • File locations
    • Snapshot changes
👉 Forensic Value:
  • Helps reconstruct original file paths even after renaming
9. System Management and Registry Control🔹 Registry Role
  • Controls:
    • Enable/disable restore points
    • Storage allocation
    • Behavior settings
🔹 Storage Management
  • Uses FIFO (First-In, First-Out) rule
  • Older restore points are deleted first
10. Forensic Applications🔹 What investigators can uncover
  • Malware presence in past states
  • Deleted files
  • System configuration changes
  • Evidence of cleanup attempts
👉 Key Insight:
  • Restore points can reveal what was intentionally removed
Key Takeaways
  • System Restore Points are system snapshots used for recovery
  • They preserve registry and file state over time
  • Stored in hidden System Volume Information directory
  • Include logs that track file changes and metadata
  • Can reveal deleted or tampered forensic evidence
Big PictureRestore points help investigators:👉 Move from current system state → historical system reconstructionMental Model
  • System snapshot → stored RP folder → logs + registry + files → forensic timeline


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy