Hi Guys and Gals,
Need some help. Just finished taking care of a CryptoWall infection (method: reformat). I was able to recover System Restore Points from the System Volume Information folder. Only the archives, not the meta data files. I have tried moving them back to the original (now reformatted) computer, to use programs like ShadowExplorer and System Restore Explorer to extract the files from them. However, they are not able to see those points, just the new restore points that the system creates. Are there any utilities that can open these like regular archives? The two programs I mention are able to see viable restore points, but not the copied ones.
I believe that due to the size of these System Restore Points and the creation date, that there are possibly viable unencrypted copies of the documents within them; however I cannot seem to place them into the System Volume Information folder for the system or helper programs above to read them. These restore points are viable archives, I just need to get into them.