2009-07-06 The Rules of Time on NTFS File System NTFS http://i.cs.hku.hk/~cisc/forensics/papers/RuleOfTime.pdf