Linked Presentation: Cost-effective Attack Forensics by Recording and Correlating File System Changes
