In the file monitor log after the installer starts to rollback i notice something is written to this file C windows\system32\config\software.log I think the files in here are used by the event log ...

At the same time, the database files associate with the registry are available in the C: \ Windows \ system32 \ config folder. These are the SYSTEM, SECURITY, SAM, DEFAULT and SOFTWARE files.

The main subfolders of the System32 folder that normally occupy space are DriverStore, FileRepository, Config, drivers, winevt, catroot, Log Files, etc.