Description and Functionality of Cabbit.exe (264996)

MORE INFORMATION

System Restore uses and generates files that can be viewed for observation and diagnosis when you suspect that there is a problem occurring with System Restore. The file Cabbit.exe is a tool developed specifically for capturing System Restore files and putting them into a text format, or other format, so that a support professional can easily view the contents.

Usage: Cabbit.exe

Cabbit.exe [(file1) (file2)..(fileN)][/w: (millisecs) [/f: (MyOwnFileName).CAB | [/a: (Suffix).CAB]

Command Line Parameters:

None - Creates a cab file with the DEFAULT filename:  (ComputerName)_ddmmyyHHMMSS.CAB

(fileN)  - Files to be added

/f: (MyOwnFileName).CAB  Creates a Cabfile with this Filename.

/a: (Suffix).CAB  Appends (Suffix).CAB to the default file name above.

/w: (millisecs) Time  Waits for InitChglogAPI for (millisecs) milliseconds.
 This option must precede "/f:" or "/a:".

				

Function

Cabbit.exe collects all information related to System Restore and puts the information in a CAB file. The CAB file name is automatically generated using the machine name and a timestamp, unless a name is specified with the /f: option.

Cabbit.exe also enumerates the System Restore APIs and forces a cabbing operation on the temporary files located in the _Restore\temp folder. This process updates the correct log files and places the temporary (*.cpy) files in the correct FS*.CAB or RG*.CAB file. If idle time detection is not determined for cabbing purposes, the size of the data store is reduced because *.tmp files build up and are not archived. As a result, FIFO may be triggered if the system is approaching the 90% data store FIFO trigger point.

Log File Information

All files cabbed and file obtention operations inside Cabbitlog.txt (inside the generated cab and in the current directory).

Key files for examining System Restore that are captured in the process of running Cabbit.exe are the files:

• Rstplog.txt - exposes the restore operations and checkpoints that have been created for the current system restore session. This is from the time that System Restore has been enabled, or the period of time between when System Restore has been active since the last FIFO operation, and until Cabbit.exe is run.
• Fifo.log - (if it exists) displays the System Restore files that have been purged as a normal function of maintaining the data store. This file, if it exists, resides in the _restore\logs folder on the system partition.
• Changelog.txt - contains the changes to the system that System Restore monitors. This file shows what operations were made, and when, to specific files.

For additional information on System Restore, click the article number below to view the article in the Microsoft Knowledge Base: