{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,8]],"date-time":"2024-09-08T15:12:08Z","timestamp":1725808328179},"publisher-location":"Cham","reference-count":12,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319125671"},{"type":"electronic","value":"9783319125688"}],"license":[{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-662-44952-3_7","type":"book-chapter","created":{"date-parts":[[2014,10,9]],"date-time":"2014-10-09T16:38:21Z","timestamp":1412872701000},"page":"87-100","source":"Crossref","is-referenced-by-count":4,"title":["Windows Event Forensic Process"],"prefix":"10.1007","author":[{"given":"Quang","family":"Do","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ben","family":"Martini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jonathan","family":"Looi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kim-Kwang","family":"Choo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"7_CR1","unstructured":"Dorian Software Blog, 4094 Security Events Lane (\n                    \n                      http:\/\/eventlogs.blogspot.com.au\/2007\/04\/4096-security-events-lane.html\n                    \n                    \n                  ), April 13, 2007."},{"issue":"3","key":"7_CR2","doi-asserted-by":"publisher","first-page":"377","DOI":"10.1109\/TMC.2011.70","volume":"11","author":"X. Fu","year":"2012","unstructured":"X. Fu, N. Zhang, A. Pingley, W. Yu, J. Wang and W. Zhao, The digital marauder\u2019s map: A WiFi forensic positioning tool, IEEE Transactions on Mobile Computing, vol. 11(3), pp. 377\u2013389, 2012.","journal-title":"IEEE Transactions on Mobile Computing"},{"key":"7_CR3","doi-asserted-by":"publisher","first-page":"120","DOI":"10.1007\/978-3-642-19513-6_10","volume-title":"Proceedings of the Second International ICST Conference on Digital Forensics and Cyber Crime","author":"N. Hashim","year":"2011","unstructured":"N. Hashim and I. Sutherland, An architecture for the forensic analysis of Windows system artifacts, Proceedings of the Second International ICST Conference on Digital Forensics and Cyber Crime, pp. 120\u2013128, 2011."},{"key":"7_CR4","first-page":"253","volume-title":"Proceedings of the Seventh International Conference on Global Security, Safety and Sustainability and the Fourth Conference on e-Democracy","author":"N. Ibrahim","year":"2011","unstructured":"N. Ibrahim, A. Al-Nemrat, H. Jahankhani and R. Bashroush, Sufficiency of Windows event log as evidence in digital forensics, Proceedings of the Seventh International Conference on Global Security, Safety and Sustainability and the Fourth Conference on e-Democracy, pp. 253\u2013262, 2011."},{"key":"7_CR5","doi-asserted-by":"crossref","unstructured":"K. Kent, S. Chevalier, T. Grance and H. Dang, Guide to Integrating Forensic Techniques into Incident Response, NIST Special Publication 800-86, National Institute of Standards and Technology, Gaithersburg, Maryland, 2006.","DOI":"10.6028\/NIST.SP.800-86"},{"key":"7_CR6","first-page":"71","volume-title":"Proceedings of the AusCERT Asia Pacific Information Technology Security Conference","author":"A. Marrington","year":"2007","unstructured":"A. Marrington, G. Mohay, A. Clark and H. Morarji, Event-based computer profiling for the forensic reconstruction of computer activity, Proceedings of the AusCERT Asia Pacific Information Technology Security Conference, pp. 71\u201387, 2007."},{"key":"7_CR7","first-page":"1","volume":"118","author":"R. McKemmish","year":"1999","unstructured":"R. McKemmish, What is forensic computing? Trends and Issues in Crime and Criminal Justice, vol. 118, pp. 1\u20136, 1999.","journal-title":"Trends and Issues in Crime and Criminal Justice"},{"key":"7_CR8","unstructured":"Microsoft, Audit Security State Change, Microsoft, Redmond, Washington (\n                    \n                      http:\/\/technet.microsoft.com\/en-us\/library\/dn311493.aspx\n                    \n                    \n                  ), 2013."},{"key":"7_CR9","unstructured":"Microsoft, Windows 7 Product Guide, Microsoft, Redmond, Washington (\n                    \n                      www.microsoft.com\/en-us\/download\/details.aspx?id=4984\n                    \n                    \n                  ), 2014."},{"issue":"S","key":"7_CR10","doi-asserted-by":"publisher","first-page":"92","DOI":"10.1016\/j.diin.2007.06.012","volume":"4","author":"R. Murphey","year":"2007","unstructured":"R. Murphey, Automated Windows event log forensics, Digital Investigation, vol. 4(S), pp. S92\u2013S100, 2007.","journal-title":"Digital Investigation"},{"key":"7_CR11","unstructured":"J. Newman, Windows 8 grabs more market share, but so do older versions, PC World, August 1, 2013."},{"issue":"S","key":"7_CR12","doi-asserted-by":"publisher","first-page":"65","DOI":"10.1016\/j.diin.2007.06.015","volume":"4","author":"A. Schuster","year":"2007","unstructured":"A. Schuster, Introducing the Microsoft Vista event log file format, Digital Investigation, vol. 4(S), pp. S65\u2013S72, 2007.","journal-title":"Digital Investigation"}],"container-title":["Lecture Notes in Computer Science","Progress in Pattern Recognition, Image Analysis, Computer Vision, and Applications"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-662-44952-3_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,28]],"date-time":"2019-05-28T03:03:53Z","timestamp":1559012633000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-662-44952-3_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319125671","9783319125688"],"references-count":12,"URL":"https:\/\/doi.org\/10.1007\/978-3-662-44952-3_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2014]]}}}