Quickie - I'm looking at an HD Image which has been the subject of selective wiping using a piece of commercial software. I was hoping to get a look at Restore Points (never done this before) but as far as I can see there is nothing in System Volume Information other than MountPointManagerRemoteDatabase (empty) and tracking.log. None of the RP* files I was expecting to see after doing some searching on this forum.
Also had a look at my own HD, exactly the same scenario.
This is a corporate environment, is it possible that we have a setting somewhere to disable Restore Points?
I've used FTK Imager and FTK 3.0 to look at the image. Subject HD is approx 4 years old and has had many Windows and Security updates applied. My own laptop is over a year old and also has had lots of Windows and Security updates.
Modification date on tracking.log in both cases is well over a year old. Tracking.log itself is 20K on both systems.
If the clues lie elsewhere (i.e. I'm being dumb) please point me in the right direction, am happy to go do research but don't know where at the mo.
Thnx
Here, let me Google that for you…
http//
http//
HTH,
h
Ah the infamous lmgtfy.com!!! Yup, was afraid it was a dumb question. "System Restore" in "System Properties" is set to Off which in our case is set by a GPO. Guess I'll have to mess with this on my home computer for general knowledge although I guess it's never going to be an issue internally is it.
Thanks Harlan )
"Guess I'll have to mess with this on my home computer for general knowledge although I guess it's never going to be an issue internally is it."
VM's my friend…the computer forensics petri dish 😉 And if a GPO gets pushed out to be "on" within the enterprise you should be prepared.
Ah the infamous lmgtfy.com!!! Yup, was afraid it was a dumb question.
Don't misunderstand…it wasn't a dumb question at all. It was a question that could have been easily researched and addressed, rather than posting the question here. Instead, what could have occurred is that you could have posted your issue and your findings.
"System Restore" in "System Properties" is set to Off which in our case is set by a GPO. Guess I'll have to mess with this on my home computer for general knowledge although I guess it's never going to be an issue internally is it.
Perhaps, perhaps not.