{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,16]],"date-time":"2026-04-16T07:02:22Z","timestamp":1776322942084,"version":"3.50.1"},"publisher-location":"Berlin, Heidelberg","reference-count":76,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783642041549","type":"print"},{"value":"9783642041556","type":"electronic"}],"license":[{"start":{"date-parts":[[2009,1,1]],"date-time":"2009-01-01T00:00:00Z","timestamp":1230768000000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2009]]},"DOI":"10.1007\/978-3-642-04155-6_2","type":"book-chapter","created":{"date-parts":[[2009,9,29]],"date-time":"2009-09-29T08:04:42Z","timestamp":1254211482000},"page":"17-36","source":"Crossref","is-referenced-by-count":85,"title":["Digital Forensic Research: The Good, the Bad and the Unaddressed"],"prefix":"10.1007","author":[{"given":"Nicole","family":"Beebe","sequence":"first","affiliation":[]}],"member":"297","reference":[{"key":"2_CR1","doi-asserted-by":"crossref","unstructured":"T. Abraham and O. de Vel, Investigative profiling with computer forensic log data and association rules, Proceedings of the IEEE International Conference on Data Mining, pp. 11\u201318, 2002.","DOI":"10.1109\/ICDM.2002.1183880"},{"key":"2_CR2","unstructured":"T. Abraham, R. Kling and O. de Vel, Investigative profile analysis with computer forensic log data using attribute generalization, Proceedings of the Fifteenth Australian Joint Conference on Artificial Intelligence, 2002."},{"key":"2_CR3","unstructured":"K. Bailey and K. Curran, An evaluation of image based steganography methods, International Journal of Digital Evidence, vol. 2(2), 2003."},{"issue":"2","key":"2_CR4","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1016\/j.diin.2005.04.002","volume":"2","author":"N. Beebe","year":"2005","unstructured":"N. Beebe and J. Clark, A hierarchical, objectives-based framework for the digital investigations process, Digital Investigation, vol. 2(2), pp. 147\u2013167, 2005.","journal-title":"Digital Investigation"},{"key":"2_CR5","first-page":"3","volume-title":"Advances in Digital Forensics","author":"N. Beebe","year":"2005","unstructured":"N. Beebe and J. Clark, Dealing with terabyte data sets in digital investigations, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 3\u201316, 2005."},{"issue":"S1","key":"2_CR6","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1016\/j.diin.2007.06.005","volume":"4","author":"N. Beebe","year":"2007","unstructured":"N. Beebe and J. Clark, Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results, Digital Investigation, vol. 4(S1), pp. 49\u201354, 2007.","journal-title":"Digital Investigation"},{"key":"2_CR7","doi-asserted-by":"crossref","unstructured":"N. Beebe, S. Stacy and D. Stuckey, Digital forensic implications of ZFS, to appear in Digital Investigation, 2009.","DOI":"10.1016\/j.diin.2009.06.006"},{"key":"2_CR8","unstructured":"D. Bem and E. Huebner, Computer forensic analysis in a virtual environment, International Journal of Digital Evidence, vol. 6(2), 2007."},{"issue":"S1","key":"2_CR9","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1016\/j.diin.2008.05.013","volume":"5","author":"A. Burghardt","year":"2008","unstructured":"A. Burghardt and A. Feldman, Using the HFS+ journal for deleted file recovery, Digital Investigation, vol. 5(S1), pp. 76\u201382, 2008.","journal-title":"Digital Investigation"},{"key":"2_CR10","doi-asserted-by":"publisher","first-page":"269","DOI":"10.1007\/978-0-387-73742-3_19","volume-title":"Advances in Digital Forensics III","author":"P. Burke","year":"2007","unstructured":"P. Burke and P. Craiger, Forensic analysis of Xbox consoles, in Advances in Digital Forensics III, P. Craiger and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 269\u2013280, 2007."},{"key":"2_CR11","unstructured":"M. Carney and M. Rogers, The Trojan made me do it: A first step in statistical based computer forensics event reconstruction, International Journal of Digital Evidence, vol. 2(4), 2004."},{"key":"2_CR12","volume-title":"File System Forensic Analysis","author":"B. Carrier","year":"2005","unstructured":"B. Carrier, File System Forensic Analysis, Addison-Wesley, Boston, Massachusetts, 2005."},{"issue":"2","key":"2_CR13","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1016\/j.diin.2005.04.006","volume":"2","author":"H. Carvey","year":"2005","unstructured":"H. Carvey, Tracking USB storage: Analysis of Windows artifacts generated by USB storage devices, Digital Investigation, vol. 2(2), pp. 94\u2013100, 2005.","journal-title":"Digital Investigation"},{"key":"2_CR14","unstructured":"F. Casadei, A. Savoldi and P. Gubian, Forensics and SIM cards: An overview, International Journal of Digital Evidence, vol. 5(1), 2006."},{"key":"2_CR15","unstructured":"E. Casey, Error, uncertainty and loss in digital evidence, International Journal of Digital Evidence, vol. 1(2), 2002."},{"issue":"S1","key":"2_CR16","doi-asserted-by":"publisher","first-page":"112","DOI":"10.1016\/j.diin.2008.05.016","volume":"5","author":"M. Cohen","year":"2008","unstructured":"M. Cohen, PyFlag \u2013 An advanced network forensic framework, Digital Investigation, vol. 5(S1), pp. 112\u2013120, 2008.","journal-title":"Digital Investigation"},{"key":"2_CR17","first-page":"233","volume-title":"Advances in Digital Forensics","author":"P. Craiger","year":"2005","unstructured":"P. Craiger, Recovering digital evidence from Linux systems, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 233\u2013244, 2005."},{"key":"2_CR18","doi-asserted-by":"publisher","first-page":"159","DOI":"10.1007\/0-387-36891-4_13","volume-title":"Advances in Digital Forensics II","author":"P. Craiger","year":"2006","unstructured":"P. Craiger and P. Burke, Mac OS X forensics, in Advances in Digital Forensics II, M. Olivier and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 159\u2013170, 2006."},{"key":"2_CR19","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1007\/978-0-387-84927-0_28","volume-title":"Advances in Digital Forensics IV","author":"P. Craiger","year":"2008","unstructured":"P. Craiger, P. Burke, C. Marberry and M. Pollitt, A virtual digital forensics laboratory, in Advances in Digital Forensics IV, I. Ray and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 357\u2013365, 2008."},{"key":"2_CR20","first-page":"33","volume-title":"Advances in Digital Forensics","author":"M. Davis","year":"2005","unstructured":"M. Davis, G. Manes and S. Shenoi, A network-based architecture for storing digital evidence, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 33\u201343, 2005."},{"issue":"4","key":"2_CR21","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1145\/604264.604272","volume":"30","author":"O. Vel de","year":"2001","unstructured":"O. de Vel, A. Anderson, M. Corney and G. Mohay, Mining email content for author identification forensics, ACM SIGMOD Record, vol. 30(4), pp. 55\u201364, 2001.","journal-title":"ACM SIGMOD Record"},{"issue":"S1","key":"2_CR22","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1016\/j.diin.2008.05.010","volume":"5","author":"A. Distefano","year":"2008","unstructured":"A. Distefano and G. Me, An overall assessment of mobile internal acquisition tool, Digital Investigation, vol. 5(S1), pp. 121\u2013127, 2008.","journal-title":"Digital Investigation"},{"issue":"S1","key":"2_CR23","doi-asserted-by":"publisher","first-page":"62","DOI":"10.1016\/j.diin.2007.06.008","volume":"4","author":"B. Dolan-Gavitt","year":"2007","unstructured":"B. Dolan-Gavitt, The VAD tree: A process-eye view of physical memory, Digital Investigation, vol. 4(S1), pp. 62\u201364, 2007.","journal-title":"Digital Investigation"},{"issue":"S1","key":"2_CR24","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1016\/j.diin.2008.05.003","volume":"5","author":"B. Dolan-Gavitt","year":"2008","unstructured":"B. Dolan-Gavitt, Forensic analysis of the Windows registry in memory, Digital Investigation, vol. 5(S1), pp. 26\u201332, 2008.","journal-title":"Digital Investigation"},{"key":"2_CR25","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1007\/978-3-642-04155-6_5","volume-title":"Advances in Digital Forensics V","author":"G. Dorn","year":"2009","unstructured":"G. Dorn, C. Marberry, S. Conrad and P. Craiger, Analyzing the impact of a virtual machine on a host machine, in Advances in Digital Forensics V, G. Peterson and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 69\u201381, 2009."},{"key":"2_CR26","unstructured":"K. Eckstein and M. Jahnke, Data hiding in journaling file systems, Proceedings of the Fifth Digital Forensic Research Workshop, 2005."},{"key":"2_CR27","unstructured":"C. Hosmer and C. Hyde, Discovering covert digital evidence, Proceedings of the Third Digital Forensic Research Workshop, 2003."},{"issue":"3-4","key":"2_CR28","doi-asserted-by":"publisher","first-page":"129","DOI":"10.1016\/j.diin.2008.02.001","volume":"4","author":"E. Huebner","year":"2007","unstructured":"E. Huebner, D. Bem, F. Henskens and M. Wallis, Persistent systems techniques in forensic acquisition of memory, Digital Investigation, vol. 4(3-4), pp. 129\u2013137, 2007.","journal-title":"Digital Investigation"},{"key":"2_CR29","unstructured":"J. Jackson, G. Gunsch, R. Claypoole and G. Lamont, Blind steganography detection using a computational immune system approach: A proposal, Proceedings of the Second Digital Forensic Research Workshop, 2002."},{"issue":"2","key":"2_CR30","doi-asserted-by":"publisher","first-page":"120","DOI":"10.1016\/j.diin.2005.04.003","volume":"2","author":"W. Jansen","year":"2005","unstructured":"W. Jansen and R. Ayers, An overview and analysis of PDA forensic tools, Digital Investigation, vol. 2(2), pp. 120\u2013132, 2005.","journal-title":"Digital Investigation"},{"issue":"S1","key":"2_CR31","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1016\/j.diin.2008.05.011","volume":"5","author":"R. Joyce","year":"2008","unstructured":"R. Joyce, J. Powers and F. Adelstein, MEGA: A tool for Mac OS X operating system and application forensics, Digital Investigation, vol. 5(S1), pp. 83\u201390, 2008.","journal-title":"Digital Investigation"},{"issue":"2","key":"2_CR32","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1016\/j.diin.2005.02.001","volume":"2","author":"E. Kenneally","year":"2005","unstructured":"E. Kenneally and C. Brown, Risk sensitive digital evidence collection, Digital Investigation, vol. 2(2), pp. 101\u2013119, 2005.","journal-title":"Digital Investigation"},{"key":"2_CR33","unstructured":"M. Kiley, T. Shinbara and M. Rogers, iPod forensics update, International Journal of Digital Evidence, vol. 6(1), 2007."},{"issue":"S1","key":"2_CR34","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1016\/j.diin.2006.06.015","volume":"3","author":"J. Kornblum","year":"2006","unstructured":"J. Kornblum, Identifying almost identical files using context triggered piecewise hashing, Digital Investigation, vol. 3(S1), pp. 91\u201397, 2006.","journal-title":"Digital Investigation"},{"issue":"1","key":"2_CR35","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1016\/j.diin.2006.12.002","volume":"4","author":"J. Kornblum","year":"2007","unstructured":"J. Kornblum, Using every part of the buffalo in Windows memory analysis, Digital Investigation, vol. 4(1), pp. 24\u201329, 2007.","journal-title":"Digital Investigation"},{"key":"2_CR36","volume-title":"Information Storage and Retrieval Systems: Theory and Implementation","author":"G. Kowalski","year":"2000","unstructured":"G. Kowalski and M. Maybury, Information Storage and Retrieval Systems: Theory and Implementation, Kluwer, Norwell, Massachusetts, 2000."},{"key":"2_CR37","unstructured":"C. Marsico and M. Rogers, iPod forensics, International Journal of Digital Evidence, vol. 4(2), 2005."},{"issue":"S1","key":"2_CR38","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1016\/j.diin.2007.06.014","volume":"4","author":"L. Marziale","year":"2007","unstructured":"L. Marziale, G. Richard and V. Roussev, Massive threading: Using GPUs to increase the performance of digital forensic tools, Digital Investigation, vol. 4(S1), pp. 73\u201381, 2007.","journal-title":"Digital Investigation"},{"issue":"1","key":"2_CR39","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1016\/j.diin.2005.01.003","volume":"2","author":"B. McBride","year":"2005","unstructured":"B. McBride, G. Peterson and S. Gustafson, A new blind method for detecting novel steganography, Digital Investigation, vol. 2(1), pp. 50\u201370, 2005.","journal-title":"Digital Investigation"},{"issue":"3","key":"2_CR40","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.diin.2005.07.004","volume":"2","author":"K. McDonald","year":"2005","unstructured":"K. McDonald, To image a Macintosh, Digital Investigation, vol. 2(3), pp. 175\u2013179, 2005.","journal-title":"Digital Investigation"},{"issue":"4","key":"2_CR41","doi-asserted-by":"publisher","first-page":"266","DOI":"10.1016\/j.diin.2004.11.007","volume":"1","author":"B. Mellars","year":"2004","unstructured":"B. Mellars, Forensic examination of mobile phones, Digital Investigation, vol. 1(4), pp. 266\u2013272, 2004.","journal-title":"Digital Investigation"},{"key":"2_CR42","unstructured":"S. Mukkamala and A. Sung, Identifying significant features for network forensic analysis using artificial intelligence techniques, International Journal of Digital Evidence, vol. 1(4), 2003."},{"key":"2_CR43","unstructured":"Net Applications, Global Market Share Statistics, Aliso Viejo, California (marketshare.hitslink.com), April 9, 2009."},{"key":"2_CR44","doi-asserted-by":"crossref","unstructured":"J. Nunamaker, N. Romano and R. Briggs, A framework for collaboration and knowledge management, Proceedings of the Thirty-Fourth Hawaii International Conference on System Sciences, 2001.","DOI":"10.1109\/HICSS.2001.926241"},{"issue":"3-4","key":"2_CR45","doi-asserted-by":"publisher","first-page":"115","DOI":"10.1016\/j.diin.2008.10.001","volume":"5","author":"M. Olivier","year":"2009","unstructured":"M. Olivier, On metadata context in database forensics, Digital Investigation, vol. 5(3-4), pp. 115\u2013123, 2009.","journal-title":"Digital Investigation"},{"key":"2_CR46","unstructured":"G. Palmer, A Road Map for Digital Forensic Research, DFRWS Technical Report, DTR-T001-01 Final, Air Force Research Laboratory, Rome, New York, 2001."},{"key":"2_CR47","unstructured":"G. Palmer, Forensic analysis in the digital world, International Journal of Digital Evidence, vol. 1(1), 2002."},{"issue":"3-4","key":"2_CR48","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1016\/j.diin.2008.12.001","volume":"5","author":"B. Park","year":"2009","unstructured":"B. Park, J. Park and S. Lee, Data concealment and detection in Microsoft Office 2007 files, Digital Investigation, vol. 5(3-4), pp. 104\u2013114, 2009.","journal-title":"Digital Investigation"},{"issue":"3","key":"2_CR49","doi-asserted-by":"publisher","first-page":"209","DOI":"10.1016\/j.diin.2005.07.002","volume":"2","author":"M. Penhallurick","year":"2005","unstructured":"M. Penhallurick, Methodologies for the use of VMware to boot cloned\/mounted subject hard disks, Digital Investigation, vol. 2(3), pp. 209\u2013222, 2005.","journal-title":"Digital Investigation"},{"key":"2_CR50","first-page":"245","volume-title":"Advances in Digital Forensics","author":"S. Piper","year":"2005","unstructured":"S. Piper, M. Davis, G. Manes and S. Shenoi, Detecting hidden data in EXT2\/EXT3 file systems, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 245\u2013256, 2005."},{"issue":"2","key":"2_CR51","doi-asserted-by":"publisher","first-page":"62","DOI":"10.1080\/15567280802047135","volume":"2","author":"M. Pollitt","year":"2008","unstructured":"M. Pollitt, K. Nance, B. Hay, R. Dodge, P. Craiger, P. Burke, C. Marberry and B. Brubaker, Virtualization and digital forensics: A research and teaching agenda, Journal of Digital Forensic Practice, vol. 2(2), pp. 62\u201373, 2008.","journal-title":"Journal of Digital Forensic Practice"},{"key":"2_CR52","doi-asserted-by":"publisher","first-page":"193","DOI":"10.1007\/978-0-387-73742-3_13","volume-title":"Advances in Digital Forensics III","author":"B. Rodriguez","year":"2007","unstructured":"B. Rodriguez and G. Peterson, Detecting steganography using multi-class classification, in Advances in Digital Forensics III, P. Craiger and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 193\u2013204, 2007."},{"key":"2_CR53","doi-asserted-by":"publisher","first-page":"345","DOI":"10.1007\/978-0-387-84927-0_27","volume-title":"Advances in Digital Forensics IV","author":"B. Rodriguez","year":"2008","unstructured":"B. Rodriguez, G. Peterson and K. Bauer, Fusion of steganalysis systems using Bayesian model averaging, in Advances in Digital Forensics IV, I. Ray and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 345\u2013355, 2008."},{"key":"2_CR54","doi-asserted-by":"crossref","unstructured":"B. Rodriguez, G. Peterson, K. Bauer and S. Agaian, Steganalysis embedding percentage determination with learning vector quantization, Proceedings of the IEEE International Conference on Systems Man and Cybernetics, vol. 3, pp. 1861\u20131865, 2006.","DOI":"10.1109\/ICSMC.2006.385001"},{"issue":"S1","key":"2_CR55","doi-asserted-by":"publisher","first-page":"82","DOI":"10.1016\/j.diin.2006.06.012","volume":"3","author":"V. Roussev","year":"2006","unstructured":"V. Roussev, Y. Chen, T. Bourg and G. Richard, md5bloom: Forensic file system hashing revisited, Digital Investigation, vol. 3(S1), pp. 82\u201390, 2006.","journal-title":"Digital Investigation"},{"key":"2_CR56","unstructured":"V. Roussev and G. Richard, Breaking the performance wall: The case for distributed digital forensics, Proceedings of the Fourth Digital Forensic Research Workshop, 2004."},{"issue":"S1","key":"2_CR57","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1016\/j.diin.2007.06.011","volume":"4","author":"V. Roussev","year":"2007","unstructured":"V. Roussev, G. Richard and L. Marziale, Multi-resolution similarity hashing, Digital Investigation, vol. 4(S1), pp. 105\u2013113, 2007.","journal-title":"Digital Investigation"},{"key":"2_CR58","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1007\/978-0-387-84927-0_9","volume-title":"Advances in Digital Forensics IV","author":"V. Roussev","year":"2008","unstructured":"V. Roussev, G. Richard and L. Marziale, Class-aware similarity hashing for data classification, in Advances in Digital Forensics IV, I. Ray and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 101\u2013113, 2008."},{"key":"2_CR59","doi-asserted-by":"publisher","first-page":"201","DOI":"10.1007\/978-3-642-04155-6_15","volume-title":"Advances in Digital Forensics V","author":"V. Roussev","year":"2009","unstructured":"V. Roussev, L. Wang, G. Richard and L. Marziale, A cloud computing platform for large-scale forensic computing, in Advances in Digital Forensics V, G. Peterson and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 201\u2013214, 2009."},{"issue":"4","key":"2_CR60","doi-asserted-by":"publisher","first-page":"190","DOI":"10.1016\/j.diin.2006.10.010","volume":"3","author":"P. Sanderson","year":"2006","unstructured":"P. Sanderson, Mass image classification, Digital Investigation, vol. 3(4), pp. 190\u2013195, 2006.","journal-title":"Digital Investigation"},{"key":"2_CR61","doi-asserted-by":"publisher","first-page":"219","DOI":"10.1007\/978-0-387-84927-0_18","volume-title":"Advances in Digital Forensics IV","author":"A. Savoldi","year":"2008","unstructured":"A. Savoldi and P. Gubian, Data recovery from Windows CE based handheld devices, in Advances in Digital Forensics IV, I. Ray and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 219\u2013230, 2008."},{"issue":"S1","key":"2_CR62","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1016\/j.diin.2006.06.010","volume":"3","author":"A. Schuster","year":"2006","unstructured":"A. Schuster, Searching for processes and threads in Microsoft Windows memory dumps, Digital Investigation, vol. 3(S1), pp. 10\u201316, 2006.","journal-title":"Digital Investigation"},{"issue":"S1","key":"2_CR63","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1016\/j.diin.2008.05.007","volume":"5","author":"A. Schuster","year":"2008","unstructured":"A. Schuster, The impact of Microsoft Windows pool allocation strategies on memory forensics, Digital Investigation, vol. 5(S1), pp. 58\u201364, 2008.","journal-title":"Digital Investigation"},{"key":"2_CR64","unstructured":"M. Shannon, Forensic relative strength scoring: ASCII and entropy scoring, International Journal of Digital Evidence, vol. 2(4), 2004."},{"key":"2_CR65","unstructured":"M. Sieffert, R. Forbes, C. Green, L. Popyack and T. Blake, Stego intrusion detection system, Proceedings of the Fourth Digital Forensic Research Workshop, 2004."},{"key":"2_CR66","volume-title":"Administrative Behavior","author":"H. Simon","year":"1947","unstructured":"H. Simon, Administrative Behavior, Macmillan, New York, 1947."},{"key":"2_CR67","doi-asserted-by":"crossref","unstructured":"J. Slay and A. Przibilla, iPod forensics: Forensically sound examination of an Apple iPod, Proceedings of the Fortieth Hawaii International Conference on System Sciences, 2007.","DOI":"10.1109\/HICSS.2007.300"},{"issue":"2","key":"2_CR68","doi-asserted-by":"publisher","first-page":"68","DOI":"10.1016\/j.diin.2007.03.002","volume":"4","author":"J. Solomon","year":"2007","unstructured":"J. Solomon, E. Huebner, D. Bem and M. Szezynska, User data persistence in physical memory, Digital Investigation, vol. 4(2), pp. 68\u201372, 2007.","journal-title":"Digital Investigation"},{"issue":"1","key":"2_CR69","doi-asserted-by":"publisher","first-page":"7","DOI":"10.1016\/j.diin.2006.12.001","volume":"4","author":"A. Spruill","year":"2007","unstructured":"A. Spruill and C. Pavan, Tackling the U3 trend with computer forensics, Digital Investigation, vol. 4(1), pp. 7\u201312, 2007.","journal-title":"Digital Investigation"},{"key":"2_CR70","first-page":"205","volume-title":"Advances in Digital Forensics","author":"C. Swenson","year":"2005","unstructured":"C. Swenson, G. Manes and S. Shenoi, Imaging and analysis of GSM SIM cards, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 205\u2013216, 2005."},{"key":"2_CR71","doi-asserted-by":"crossref","unstructured":"P. Turner, Unification of digital evidence from disparate sources (digital evidence bags), Proceedings of the Fifth Digital Forensic Research Workshop, 2005.","DOI":"10.1016\/j.diin.2005.07.001"},{"issue":"S1","key":"2_CR72","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1016\/j.diin.2006.06.003","volume":"3","author":"P. Turner","year":"2006","unstructured":"P. Turner, Selective and intelligent imaging using digital evidence bags, Digital Investigation, vol. 3(S1), pp. 59\u201364, 2006.","journal-title":"Digital Investigation"},{"issue":"S1","key":"2_CR73","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1016\/j.diin.2008.05.014","volume":"5","author":"R. Baar van","year":"2008","unstructured":"R. van Baar, W. Alink and A. van Ballegooij, Forensic memory analysis: Files mapped in memory, Digital Investigation, vol. 5(S1), pp. 52\u201357, 2008.","journal-title":"Digital Investigation"},{"issue":"3","key":"2_CR74","doi-asserted-by":"publisher","first-page":"165","DOI":"10.1016\/j.diin.2004.07.006","volume":"1","author":"C. Vaughan","year":"2004","unstructured":"C. Vaughan, Xbox security issues and forensic recovery methodology (utilizing Linux), Digital Investigation, vol. 1(3), pp. 165\u2013172, 2004.","journal-title":"Digital Investigation"},{"key":"2_CR75","unstructured":"M. Weier, Hewlett-Packard data warehouse lands in Wal-Mart\u2019s shopping cart, InformationWeek, August 4, 2007."},{"key":"2_CR76","first-page":"191","volume-title":"Advances in Digital Forensics","author":"S. Willassen","year":"2005","unstructured":"S. Willassen, Forensic analysis of mobile phone internal memory, in Advances in Digital Forensics, M. Pollitt and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 191\u2013204, 2005."}],"container-title":["IFIP Advances in Information and Communication Technology","Advances in Digital Forensics V"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-642-04155-6_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,22]],"date-time":"2019-05-22T18:38:40Z","timestamp":1558550320000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-642-04155-6_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009]]},"ISBN":["9783642041549","9783642041556"],"references-count":76,"URL":"https:\/\/doi.org\/10.1007\/978-3-642-04155-6_2","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"value":"1868-4238","type":"print"},{"value":"1868-422X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009]]}}}