Analyze and Display Windows restore point information

This Perl script allows you to see contents of a restore point for Windows. It is very useful in analyzing windows information on a disk from a failed machine. Run this script from a working station after mounting the disk from a broken system.

There is also a script to Restore files from a Windows Restore Point.

# this code will parse up the Windows Restore point information and display it
use warnings;
use Switch;
use IO::Seekable qw(SEEK_SET SEEK_CUR SEEK_END);

defined ($dir) || die "Just give me a folder like C:\\System Volume Information\\_restore{...}\\RP28 as a parameter and I will do the rest\n";
$verbose=1 if (defined($ops) && $ops eq "-v");
$|=1; # autoflush stdio
open(F, "$dir/rp.log") || die "cant open rp.log";
print unidecode($name);
print "Restore point type:".unpack("h4",$type)." date:".unpack("h16",$datetime)."\n" if $verbose;
opendir(DIR, "$dir") || die "cant open $dir";
my @entities=grep(/change\.log.*/i, readdir DIR);
foreach my $entity (@entities) {
print "Changes in $entity:\n" if $verbose;
open (F,"$dir/$entity") || die "$dir/$entity";
while (sysread(F,$temp,4) != 0){
  if ($sig ne "21fedcba"){
    print "invalid signature $sig\n";
    exit 1;
  print "Rec $i len:$len type:$type" if $verbose;
  if ($type == 0){ # changelog name
    print " len:$reclen change log:".unidecode(substr($payload,12,length($payload)-12))."\n" if $verbose;
  } elsif ($type == 1){ # file name
    print " type:" if $verbose;
    switch ($changetype){
        case 0x00000001 {print "Modify File      "}
        case 0x00000002 {print "Update ACL       "}
        case 0x00000004 {print "Update Attributes"}
        case 0x00000010 {print "Delete File      "}
        case 0x00000020 {print "Create File      "}
        case 0x00000040 {print "Rename File      "}
        case 0x00000080 {print "Create directory "}
        case 0x00000100 {print "Rename directory "}
        case 0x00000200 {print "Delete directory "}
        case 0x00000400 {print "MNT-CREATE"}
    print " flags:$flags attr:$attributes eventid:$eventid\n" if $verbose;
    while ($offset < $len-16){
        if ($fieldlen==0) {
            print "ups";
            exit 1;
        print "> Field $j subtype:" if $verbose;
        if ($verbose){
            switch ($fieldtype){
                case 0x00000003 {print "long original filename"}
                case 0x00000004 {print "long new filename     "}
                case 0x00000005 {print "backup filename       "}
                case 0x00000006 {print "ACL                   "}
                case 0x00000009 {print "short orig filename   "}
                case 0x0000000A {print "short new filename    "}
            print " contents:".(($fieldtype == 0x00000006)?unpack("h*",$field):unidecode($field))."\n";
        } else {
            switch ($fieldtype){
                case 0x00000003 {print "O:"}
                case 0x00000004 {print "N:"}
                case 0x00000005 {print "b:"}
                case 0x0000000A {print "n:"}
            print unidecode($field)." " if ($fieldtype != 0x00000006 && $fieldtype !=0x00000009);
    print "\n" if not $verbose;
close F;

sub unidecode {
    while ($off < length($data) && (substr($data,$off,1) ne "\0")){
#       print substr($data,$offset,1)."-".$offset."\n";

@Tools @Windows

Backlinks: and Scripts:Restore files from a Windows Restore Point