2009-09-28 Using shellbag information to reconstruct user activities sec http://www.dfrws.org/2009/proceedings/p69-zhu.pdf