{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,6]],"date-time":"2026-04-06T10:17:13Z","timestamp":1775470633678,"version":"3.50.1"},"reference-count":24,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2009,9,1]],"date-time":"2009-09-01T00:00:00Z","timestamp":1251763200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2019,1,18]],"date-time":"2019-01-18T00:00:00Z","timestamp":1547769600000},"content-version":"vor","delay-in-days":3426,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Digital Investigation"],"published-print":{"date-parts":[[2009,9]]},"DOI":"10.1016\/j.diin.2009.06.010","type":"journal-article","created":{"date-parts":[[2009,8,19]],"date-time":"2009-08-19T08:33:54Z","timestamp":1250670834000},"page":"S57-S68","source":"Crossref","is-referenced-by-count":51,"special_numbering":"S","title":["Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow"],"prefix":"10.1016","volume":"6","author":[{"given":"Michael","family":"Cohen","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Simson","family":"Garfinkel","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Bradley","family":"Schatz","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.diin.2009.06.010_bib19","author":"B.S. NTI Forensics Source"},{"key":"10.1016\/j.diin.2009.06.010_bib1","doi-asserted-by":"crossref","unstructured":"Berners-Lee T, Masinter L, McCahill M. RFC 1738: uniform resource locators (URL), Dec. 1994, updated by RFC1808, RFC2368 [23][24]. Status: PROPOSED STANDARD.","DOI":"10.17487\/rfc1738"},{"key":"10.1016\/j.diin.2009.06.010_bib2","author":"Carrier"},{"issue":"3\u20134","key":"10.1016\/j.diin.2009.06.010_bib3","doi-asserted-by":"crossref","first-page":"119","DOI":"10.1016\/j.diin.2007.10.001","article-title":"Advanced carving techniques","volume":"4","author":"Cohen","year":"2007","journal-title":"Digital Investigation"},{"key":"10.1016\/j.diin.2009.06.010_bib4","series-title":"Proceedings of the 2008 digital forensics research workshop. DFRWS","article-title":"Pyflag: an advanced network forensic framework [Online]","author":"Cohen","year":"2008"},{"key":"10.1016\/j.diin.2009.06.010_bib5","series-title":"e-Forensics '08: proceedings of the 1st international conference on forensic applications and techniques in telecommunications, information, and multimedia and workshop","first-page":"1","article-title":"Advanced jpeg carving","author":"Cohen","year":"2008"},{"key":"10.1016\/j.diin.2009.06.010_bib6","author":"Cohen"},{"key":"10.1016\/j.diin.2009.06.010_bib7","doi-asserted-by":"crossref","unstructured":"Fielding R, RFC 1808: Relative uniform resource locators, Jun. 1995, updates RFC1738 [13]. Updated by RFC2368 [24]. Status: PROPOSED STANDARD.","DOI":"10.17487\/rfc1808"},{"key":"10.1016\/j.diin.2009.06.010_bib8","author":"Fielding"},{"key":"10.1016\/j.diin.2009.06.010_bib10","doi-asserted-by":"crossref","DOI":"10.4018\/jdcf.2009010101","article-title":"Providing cryptographic security and evidentiary chain-of-custody with the advanced forensic format, library, and tools","volume":"1","author":"Garfinkel","year":"2009","journal-title":"The International Journal of Digital Crime and Forensics"},{"key":"10.1016\/j.diin.2009.06.010_bib9","series-title":"Research advances in digital forensics (second annual IFIP WG 11.9 international conference on digital forensics)","article-title":"Disk imaging with the advanced forensic format, library and tools","author":"Garfinkel","year":"2006"},{"key":"10.1016\/j.diin.2009.06.010_bib11","author":"Goland"},{"key":"10.1016\/j.diin.2009.06.010_bib12","author":"Guidance Software, Inc"},{"key":"10.1016\/j.diin.2009.06.010_bib13","doi-asserted-by":"crossref","unstructured":"Hoffman P, Masinter L, Zawinski J, RFC 2368: the mailto URL scheme, Jul. 1998, updates RFC1738, RFC1808 [13], [23]. Status: PROPOSED STANDARD.","DOI":"10.17487\/rfc2368"},{"key":"10.1016\/j.diin.2009.06.010_bib18","author":"Ilook investigator"},{"key":"10.1016\/j.diin.2009.06.010_bib14","series-title":"APPNOTE.TXT \u2014 .ZIP file format specification","author":"Katz","year":"2007"},{"key":"10.1016\/j.diin.2009.06.010_bib15","author":"Keightley"},{"key":"10.1016\/j.diin.2009.06.010_bib16","author":"Kloet"},{"key":"10.1016\/j.diin.2009.06.010_bib17","author":"Leach"},{"key":"10.1016\/j.diin.2009.06.010_bib20","unstructured":"Schatz BL, Clark A, An information architecture for digital evidence integration, In: Australian security response team annual conference; 2006."},{"key":"10.1016\/j.diin.2009.06.010_bib21","doi-asserted-by":"crossref","unstructured":"Sollins K, Masinter L, RFC 1737: Functional requirements for uniform resource names, Dec. 1994, status: INFORMATIONAL.","DOI":"10.17487\/rfc1737"},{"key":"10.1016\/j.diin.2009.06.010_bib22","series-title":"Modern operating systems","author":"Tanenbaum","year":"2008"},{"key":"10.1016\/j.diin.2009.06.010_bib23","author":"Various"},{"key":"10.1016\/j.diin.2009.06.010_bib24","unstructured":"Zero storage carving; Nov. 2006."}],"container-title":["Digital Investigation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1742287609000401?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1742287609000401?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2019,5,22]],"date-time":"2019-05-22T02:28:22Z","timestamp":1558492102000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1742287609000401"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,9]]},"references-count":24,"alternative-id":["S1742287609000401"],"URL":"https:\/\/doi.org\/10.1016\/j.diin.2009.06.010","relation":{},"ISSN":["1742-2876"],"issn-type":[{"value":"1742-2876","type":"print"}],"subject":[],"published":{"date-parts":[[2009,9]]}}}