I have evidence that Cryptolocker went live on a client because a shared network drive was littered with the Help_Decrypt files all of which carried the user's name. No problem, restored from backup. However on the client itself it appears that webroot did as advertised and cleared up the infection, quaranteened the offending dropper and restored all encrypted files.

 

Now onto the forensics of the event. Where can I see the logs that record exactly what happened and what actions were performed?