An effective links these concepts. It tells you: "Amcache (Book 2, p. 89) -> Volatility 'malfind' (Book 4, p. 210)."
FN, $DATA) and timestamp behavior (Standard Information vs. Filename). 3. Pro Indexing Strategy for508 index