#DFIR, get a head start on ReFS analysis by helping reverse the capabilities and structures: http://www.williballenthin.com/forensics/refs/index.html