Windows Forensic Analysis Toolkit
Advanced Analysis Techniques for Windows 8
Fourth Edition
Harlan Carvey