Forensics of file system