Title: Determining intrusion activity for file-system recovery
First published: 2005