netsvcs
drivers32
/md5start
explorer.exe
winlogon.exe
userinit.exe
svchost.exe
csrss.exe
msgina.dll
/md5stop 
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\Windows\MiniDump 
c:\system volume information|_REGISTRY_MACHINE_SYSTEM;true;true;true /FP
c:\system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP
c:\|winnt32;true;true;true /FP