{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,26]],"date-time":"2025-03-26T04:19:17Z","timestamp":1742962757987,"version":"3.40.3"},"publisher-location":"Cham","reference-count":15,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319672076"},{"type":"electronic","value":"9783319672083"}],"license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"DOI":"10.1007\/978-3-319-67208-3_15","type":"book-chapter","created":{"date-parts":[[2017,8,30]],"date-time":"2017-08-30T12:21:00Z","timestamp":1504095660000},"page":"269-284","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Automated Collection and Correlation of File Provenance Information"],"prefix":"10.1007","author":[{"given":"Ryan","family":"Good","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gilbert","family":"Peterson","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,8,31]]},"reference":[{"issue":"S","key":"15_CR1","first-page":"S78","volume":"6","author":"F Buchholz","year":"2005","unstructured":"Buchholz, F., Falk, C.: Design and implementation of Zeitline: A forensic timeline. Digital Investigation 6(S), S78\u2013S87 (2005)","journal-title":"Digital Investigation"},{"key":"15_CR2","volume-title":"Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry","author":"H Carvey","year":"2016","unstructured":"Carvey, H.: Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry. Syngress, Cambridge (2016)"},{"issue":"S","key":"15_CR3","doi-asserted-by":"publisher","first-page":"S65","DOI":"10.1016\/j.diin.2008.05.008","volume":"5","author":"A Case","year":"2008","unstructured":"Case, A., Cristina, A., Marziale, L., Richard, G., Roussev, V.: FACE: Automated digital evidence discovery and correlation. Digital Investigation 5(S), S65\u2013S75 (2008)","journal-title":"Digital Investigation"},{"key":"15_CR4","unstructured":"Gudjonsson, K.: Mastering the super timeline with log2timeline. InfoSec Reading Room. SANS Institute, Bethesda (2010). www.sans.org\/reading-room\/whitepapers\/logging\/mastering-super-timeline-log2timeline-33438"},{"issue":"S","key":"15_CR5","doi-asserted-by":"publisher","first-page":"S69","DOI":"10.1016\/j.diin.2012.05.006","volume":"9","author":"C Hargreaves","year":"2012","unstructured":"Hargreaves, C., Patterson, J.: An automated timeline reconstruction approach for digital forensic investigations. Digital Investigations 9(S), S69\u2013S79 (2012)","journal-title":"Digital Investigations"},{"key":"15_CR6","unstructured":"Harvey, P.: ExifTool (2017). www.sno.phy.queensu.ca\/~phil\/exiftool"},{"key":"15_CR7","doi-asserted-by":"crossref","unstructured":"Jensen, C., Lonsdale, H., Wynn, E., Cao, J., Slater, M., Dietterich, T.: The life and times of files and information: a study of desktop provenance. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 767\u2013776 (2010)","DOI":"10.1145\/1753326.1753439"},{"key":"15_CR8","unstructured":"Lenik, G.: I\u2019m your MAC(b) daddy. Presented at DEF CON 19 (2011)"},{"key":"15_CR9","unstructured":"Margo, D., Smogor, R.: Using provenance to extract semantic file attributes. In: Proceedings of the Second Conference on Theory and Practice of Provenance (2010)"},{"key":"15_CR10","unstructured":"Muniswamy-Reddy, K., Holland, D., Braun, U., Seltzer, M.: Provenance-aware storage systems. In: Proceedings of the USENIX Annual Technical Conference (2006)"},{"key":"15_CR11","unstructured":"NirSoft, IEHistoryView v1.70 (2011). www.nirsoft.net\/utils\/iehv.html"},{"key":"15_CR12","unstructured":"NirSoft, ChromeHistoryView v1.30 (2017). www.nirsoft.net\/utils\/chrome_history_view.html"},{"key":"15_CR13","unstructured":"Shavers, B.: RegRipper (2015). brettshavers.cc\/index.php\/brettsblog\/entry\/regripper"},{"key":"15_CR14","doi-asserted-by":"crossref","unstructured":"Sultana, S., Bertino, E.: A file provenance system. In: Proceedings of the Third ACM Conference on Data and Application Security and Privacy, pp. 153\u2013156 (2013)","DOI":"10.1145\/2435349.2435368"},{"key":"15_CR15","unstructured":"Zadok, E., Badulescu, I.: A stackable filesystem interface for Linux. In: Proceedings of the LinuxExpo Conference, pp. 141\u2013151 (1999)"}],"container-title":["IFIP Advances in Information and Communication Technology","Advances in Digital Forensics XIII"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-67208-3_15","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,8,31]],"date-time":"2021-08-31T00:06:27Z","timestamp":1630368387000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-67208-3_15"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"ISBN":["9783319672076","9783319672083"],"references-count":15,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-67208-3_15","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"type":"print","value":"1868-4238"},{"type":"electronic","value":"1868-422X"}],"subject":[],"published":{"date-parts":[[2017]]},"assertion":[{"value":"31 August 2017","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DigitalForensics","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP International Conference on Digital Forensics","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Orlando","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"USA","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2017","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 January 2017","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"1 February 2017","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"digitalforensics2017","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.ifip119.org\/Conferences\/ConferenceProgram2017.pdf","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}