In the file monitor log after the installer starts to rollback i notice something is written to this file C windows\system32\config\software.log I think the files in here are used by the event log ...