Please follow
http://csrc.nist.gov/cyberframework/documents/recover-session-read-ahead.pdf
.