Ross AndrewsWindows Forensics: Office DocumentsWindows Forensics — Evidence of: File/Folder Opening, Application ExecutionJun 13Jun 13