Think I have found it in ... HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
-----Original Message----- From: ProfoxTech [mailto:[email protected]] On Behalf Of Dave Crozier Sent: 20 April 2015 15:30 To: [email protected] Subject: RE: [NF] System Restore Chris, See what you mean.... I'll dig around Dave -----Original Message----- From: ProFox [mailto:[email protected]] On Behalf Of Chris Davis Sent: 20 April 2015 15:02 To: [email protected] Subject: RE: [NF] System Restore It's not so much which ones been used just if ones been used at all, we are trying to prove that someone has performed a system restore. -----Original Message----- From: ProfoxTech [mailto:[email protected]] On Behalf Of Dave Crozier Sent: 20 April 2015 14:23 To: [email protected] Subject: RE: [NF] System Restore Restoring to a past restore point removes all the newer restore points automatically. So if you have restored back then the latest on that "may have been used" will always be the latest one. Dave -----Original Message----- From: ProFox [mailto:[email protected]] On Behalf Of Chris Davis Sent: 20 April 2015 14:16 To: [email protected] Subject: RE: [NF] System Restore It's not so much if there is one available, more a question of if one has been used. -----Original Message----- From: ProfoxTech [mailto:[email protected]] On Behalf Of Dave Crozier Sent: 20 April 2015 14:13 To: [email protected] Subject: RE: [NF] System Restore Chris, With a command window do: Powershell Get-computerrestorepoint You could automate this In VFP using a run command to get a list of all the recent restore points. You could pipe (redirect) this output to a txt file to analyse it further. Dave -----Original Message----- From: ProFox [mailto:[email protected]] On Behalf Of Chris Davis Sent: 20 April 2015 14:10 To: [email protected] Subject: RE: [NF] System Restore I presume that if we had stored some incremental values in the registry and then the system was restored that the values with have gone back to the values at the time when the system restore point was created. -----Original Message----- From: ProfoxTech [mailto:[email protected]] On Behalf Of Dave Crozier Sent: 20 April 2015 14:08 To: [email protected] Subject: RE: [NF] System Restore Here's a small C# routine that returns true if a restore point is available. Shouldn't be too difficult to convert to VFP. public static bool SysRestoreAvailable() { int majorVersion = Environment.OSVersion.Version.Major; int minorVersion = Environment.OSVersion.Version.Minor; StringBuilder sbPath = new StringBuilder(260); // See if DLL exists if (SearchPath(null, "srclient.dll", null, 260, sbPath, null) != 0) return true; // Windows ME if (majorVersion == 4 && minorVersion == 90) return true; // Windows XP if (majorVersion == 5 && minorVersion == 1) return true; // Windows Vista if (majorVersion == 6 && minorVersion == 0) return true; // Windows Se7en if (majorVersion == 6 && minorVersion == 1) return true; // All others : Win 95, 98, 2000, Server return false; } System restore is available on the PC if the above method returns true, however I think that would always be the case if a full windows install had been done judging by the fact that it only checks if srclient.dll is present or not. I also came across this powershell page that allows you to do it via PS which may be more helpful. http://ss64.com/ps/get-computerrestorepoint.html Dave -----Original Message----- From: ProFox [mailto:[email protected]] On Behalf Of Chris Davis Sent: 20 April 2015 13:52 To: [email protected] Subject: [NF] System Restore Hi All, Is there any way of knowing if system restore has been used? Thanks Chris. ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________ --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html --- [excessive quoting removed by server] _______________________________________________ Post Messages to: [email protected] Subscription Maintenance: http://mail.leafe.com/mailman/listinfo/profox OT-free version of this list: http://mail.leafe.com/mailman/listinfo/profoxtech Searchable Archive: http://leafe.com/archives/search/profox This message: http://leafe.com/archives/byMID/profox/[email protected] ** All postings, unless explicitly stated otherwise, are the opinions of the author, and do not constitute legal or medical advice. This statement is added to the messages for those lawyers who are too stupid to see the obvious.
