Forensic Analysis?

[Joel]

You can see the test - System Restore can be on, but if there are no images, it's as good as off, isn't it?

[ZCode]

You can see the test - System Restore can be on, but if there are no images, it's as good as off, isn't it?

Where is the test?

I actually just tested this myself. When eraser erases the unused space, Windows does not delete ALL the restore points all the time. Sometimes it left one, sometimes it left two. Sure enough the older restore points are erased, but the fact that there might be one or two left still poses a security threat.

[DavidHB]

Did Joel mean 'text', I wonder?

The warning appears in the task log, if Eraser detects that System Restore is or has been enabled.

And I repeat: Eraser does not remove extant restore points.

David

[Joel]

In the source code file you pointed out. I meant test - the test which will determine if Eraser thinks Shadow Copies are "enabled" (currently we're only equating existance of shadow copies with it being enabled). I don't think there's a way to determine if it's just enabled for the drive if there are no shadow copies currently enabled.