Design and Implementation of a Tool for System Restore Point Analysis

When a digital investigation is carried out, the main goal of the forensic practitioner is to find out evidence related to a digital crime on the computer under examination. To make the situation more severe, the perpetrator might have destroyed the evidence, for instance, by deleting the software which has been used to commit illicit actions. Moreover, he/she might have used sophisticated anti-forensic techniques to deceive the forensic examination. Fortunately, on Windows XP-based computer systems, it is possible to observe such attack methods by means of system restore point (SRP) analysis. Although the suspect might have removed files or uninstalled applications related to a digital crime, it will be possible to find out traces by analyzing such SRP data structure. We have, therefore, developed an analysis tool that acquires information from the SRP database and analyzes it, by presenting results in a useful format for the forensic examiner. Finally, we have provided a case of study which exemplifies the implemented tool.