Very interesting article about Restore Point Forensics in Windows XP
http://windowsir.blogspot.com/2006/10/restore-point-forensics.html
-Urs