On Tue, 26 Dec 2017 17:57:04 +0000, "J. P. Gilliver (John)"
wrote:

In message , Paul
writes:
[]
On WinXP, files outside your "My Documents" tree
are tracked. Say you normally keep Firefox downloads
[]
Restore Point. Files kept in the "officially blessed"
parts of C: are unaffected, so nothing in My Documents
gets added or subtracted to match the way it was
three days ago.

Paul

Are you saying _everything_ else - or maybe everything else on C: - gets
tracked, and potentially restored (synced)? This must make for a huge
tracking area (if for example you [or the system] delete a few feature
films).

They have another record in the NTFS stream and also various
in the registry. Long after you deleted the original files. Yes, it's
there for forensic purposes. What else ?
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012