Forensics from the sausage factory: Link Files within System Restore Points 参考 http://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf Forensic Analysis of System Restore Points in Microsoft Windows XP