Timelining

Nice post about timelining for Windows images:

http://computer-forensics.sans.org/blog/2011/08/01/ultimate-windows-timelining