A system for restoring a file system to a state at a point-in-time, the system comprising: an electronic processor configured to receive the point-in-time, automatically retrieve entries from a change log representing changes made to items within the file system after the point-in-time to identify items deleted from the file system after the point-in-time, items created within the file system after the point-in time, items moved within the file system after the point-in-time, items copied within the file system after the point-in-time, items renamed within the file system after the point-in-time, and items with content modified after the point-intime, and automatically process the entries retrieved from the change log in reverse order to roll back the changes made to the items within the file system after the point-in-time and restore the file system to the state at the point-in-time, wherein the electronic processor processes the entries retrieved from the change log by automatically restoring, from a recycle bin, the items deleted from the file system after the point-in-time, automatically deleting, from the file system, the items created within the file system after the point-in-time, automatically moving the items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time, automatically deleting, from the file system, the items copied within the file system after the point-in-time, automatically renaming the items renamed within the file system after the point-in-time to a name associated with the point-in-time, and automatically restoring, from a version history, a version associated with the point-in-time for the items with content modified after the point-in-time. receive the point-in-time, automatically retrieve entries from a change log representing changes made to items within the file system after the point-in-time to identify items deleted from the file system after the point-in-time, items created within the file system after the point-in time, items moved within the file system after the point-in-time, items copied within the file system after the point-in-time, items renamed within the file system after the point-in-time, and items with content modified after the point-intime, and automatically process the entries retrieved from the change log in reverse order to roll back the changes made to the items within the file system after the point-in-time and restore the file system to the state at the point-in-time, wherein the electronic processor processes the entries retrieved from the change log by automatically restoring, from a recycle bin, the items deleted from the file system after the point-in-time, automatically deleting, from the file system, the items created within the file system after the point-in-time, automatically moving the items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time, automatically deleting, from the file system, the items copied within the file system after the point-in-time, automatically renaming the items renamed within the file system after the point-in-time to a name associated with the point-in-time, and automatically restoring, from a version history, a version associated with the point-in-time for the items with content modified after the point-in-time. automatically restoring, from a recycle bin, the items deleted from the file system after the point-in-time, automatically deleting, from the file system, the items created within the file system after the point-in-time, automatically moving the items moved within the file system after the point-in-time to a location within the file system associated with the point-in-time, automatically deleting, from the file system, the items copied within the file system after the point-in-time, automatically renaming the items renamed within the file system after the point-in-time to a name associated with the point-in-time, and automatically restoring, from a version history, a version associated with the point-in-time for the items with content modified after the point-in-time.