Restore Point Change.log.x file parser/interpreter?

Hello all,

I have a case where I am interested in some LNK files. The LNK files, however, are all in restore point subdirectories with name of A00xxxxxxx.lnk. The Restore Point "change.log" file gives the information of what the original files were. Just looking in FTKs "Filtered Text" view, it appears the Axxxxxxx.lnk entries are alongside LNK files that were in the …./Recent directory for a given user.

I wondered if anyone knew of a "change.log" parser? This would be similar to the way programs like FTK and iLook interpret the data in a LNK file and present each field in an easy to read format.

If not, does anyone know where a spec for change.log files is?

Thanks.

Evan Read