Forensic Zero-Knowledge Event Reconstruction on Filesystem Metadata.
Data Mining: Concepts and Techniques