Hi Hugh

     Sorry for the late reply. The files in the volume info are protected by Windows File protection and once the restore points gets deleted by turning the sys restore OFF, the files associated with the older restore points will get deleted automatically once the allocated size for the system restore exceeds. Other Programs cannot play with the system restore files when they are under the protection of WFP and once their Restore points get deleted they can be modified by other programs, So that the AV Program can remove the nasties in that folder. By default the system will make a snapshot of the Computer randomly for the Last Known Good Configuration at those times these orphaned files will get removed and cleaned up by the Windows itself.

    You can recover those files without the restore point entry using the recovery console in the command mode. But it should be done within a less interval before the Windows cleans-up those files.