Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
3
Posts
2
Users
0
Reactions
2,163
Views
Topic starter
12/04/2015 3:26 am
I am working on a case where I need to find system restore logs (when a Windows 7 system was restored). In the Windows 7 event logs I discovered several system restores under the Application.evtx windows event log.
I also discovered several files under the \Windows\Logs\SystemRestore directory
Questions
#1. Do the "SrTask.0.etl files show system restores that were accomplished as part of a pre-set system task?
#2. Is the restore.0.etl a user initiated system restore?
12/04/2015 9:44 pm
yes i tought because in my computer there is no task to restore computer and as you can see from the picture
13/04/2015 3:06 am
you can olso look change log of system volume informaiton folder what is volume shadow copy(system restore) source files to control that