{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T20:22:51Z","timestamp":1783369371235,"version":"3.54.6"},"reference-count":15,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T00:00:00Z","timestamp":1777075200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100005416","name":"Research Council of Norway","doi-asserted-by":"publisher","award":["338691"],"award-info":[{"award-number":["338691"]}],"id":[{"id":"10.13039\/501100005416","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Forensic Science International: Digital Investigation"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.fsidi.2026.302111","type":"journal-article","created":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T03:22:15Z","timestamp":1777605735000},"page":"302111","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Cybercrime investigations in practice: Insights from the LockerGoga ransomware attack on Norsk Hydro"],"prefix":"10.1016","volume":"57","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-3937-4715","authenticated-orcid":false,"given":"Odin","family":"Heitmann","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jan William","family":"Johnsen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.fsidi.2026.302111_bib0010","author":"Briggs"},{"key":"10.1016\/j.fsidi.2026.302111_bib0015","series-title":"Proposal for a Practical Advisor for Law Enforcement Information Exchange","year":"2018"},{"key":"10.1016\/j.fsidi.2026.302111_bib0030","series-title":"Improving Cooperation Between CSIRTs and Law Enforcement: Legal and Organisational Aspects","year":"2017"},{"key":"10.1016\/j.fsidi.2026.302111_bib0035","series-title":"Tools and Methodologies to Support Cooperation Between CSIRTs and Law Enforcement","year":"2017"},{"key":"10.1016\/j.fsidi.2026.302111_bib0040","series-title":"Cooperation Between CSIRTs and Law Enforcement","year":"2018"},{"key":"10.1016\/j.fsidi.2026.302111_bib0055","series-title":"NIKT: Norsk IKT-Konferanse for Forskning Og Utdanning 2023 (3)","article-title":"Exploring digital forensic readiness: a preliminary study from a law enforcement perspective","author":"Heitmann","year":"2023"},{"key":"10.1016\/j.fsidi.2026.302111_bib0060","doi-asserted-by":"crossref","first-page":"e151","DOI":"10.1002\/spy2.151","article-title":"Digital forensic readiness intelligence crime repository","volume":"4","author":"Kebande","year":"2021","journal-title":"Secur. Priv."},{"key":"10.1016\/j.fsidi.2026.302111_bib0070","series-title":"Practical Research: Planning and Design (Global Edition)","author":"Leedy","year":"2020"},{"key":"10.1016\/j.fsidi.2026.302111_bib0075","series-title":"Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains","year":"2011"},{"key":"10.1016\/j.fsidi.2026.302111_bib0100","series-title":"Inspeksjonsrapport Etterforskningsplaner S\u00f8r-Vest Politidistrikt 2022","year":"2022"},{"key":"10.1016\/j.fsidi.2026.302111_bib0110","article-title":"Understanding the role of case management systems in criminal investigations","volume":"84","author":"Skipanes","year":"2025","journal-title":"International Journal of Law, Crime and Justice"},{"key":"10.1016\/j.fsidi.2026.302111_bib0115","series-title":"Human Factors Methods: A Practical Guide for Engineering and Design","author":"Stanton","year":"2013"},{"key":"10.1016\/j.fsidi.2026.302111_bib0120","first-page":"13","article-title":"Cyber investigation process","author":"Sunde","year":"2023"},{"key":"10.1016\/j.fsidi.2026.302111_bib0125","first-page":"1410","article-title":"A guide to abductive thematic analysis","volume":"27","author":"Thompson","year":"2022","journal-title":"The Qualitative Report"},{"key":"10.1016\/j.fsidi.2026.302111_bib0130","author":"Whittaker"}],"container-title":["Forensic Science International: Digital Investigation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281726000685?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281726000685?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T20:09:48Z","timestamp":1783368588000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2666281726000685"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":15,"alternative-id":["S2666281726000685"],"URL":"https:\/\/doi.org\/10.1016\/j.fsidi.2026.302111","relation":{},"ISSN":["2666-2817"],"issn-type":[{"value":"2666-2817","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Cybercrime investigations in practice: Insights from the LockerGoga ransomware attack on Norsk Hydro","name":"articletitle","label":"Article Title"},{"value":"Forensic Science International: Digital Investigation","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.fsidi.2026.302111","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"302111"}}