[forensic] Link Files within System Restore Points

Forensics from the sausage factory: Link Files within System Restore Points
screenshot

参考
http://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf
Forensic Analysis of System Restore Points in Microsoft Windows XP