Windows Forensic Analysis Toolkit : Advanced Analysis Techniques for Windows 7 - Carvey, Harlan (Syngress, 2012)