https://systw.net/note/archives/351
Win Forensics(File)