Experienced "SANS-ers" often break their index into sections:
Volatility plugins ( pslist , malfind , pstree ) and what each reveals. Filesystem Internals: NTFS attributes ( for508 index