ReFS sleuthkit implementation