Very interesting article about Restore Point Forensics in Windows XP

http://windowsir.blogspot.com/2006/10/restore-point-forensics.html

-Urs