Using shellbag information to reconstruct user activities

http://www.dfrws.org/2009/proceedings/p69-zhu.pdf
screenshot