Windows Forensic Analysis, 2007. ,
Counter-Forensic Privacy Tools: A Forensic Evaluation, isri20 05/CMU-ISRI-05-119.pdf), 2005. ,
DOI : 10.1109/msp.2006.132
Rigorous development of automated inconsistency checks for digital evidence using the B method, International Journal of Digital Evidence, vol.6, issue.2, pp.1-21, 2007. ,
Formalizing event time bounding in digital investigations, International Journal of Digital Evidence, vol.4, issue.2, pp.1-14, 2005. ,
Anti-forensics with a small army of exploits, Digital Investigation, pp.13-15, 2007. ,
DOI : 10.1016/j.diin.2007.01.005
Hypothesis-based investigation of digital timestamps, in Advances in Digital Forensics IV, I, pp.75-86, 2008. ,
Using shellbag information to reconstruct user activities, Digital Investigation, pp.69-77, 2009. ,
DOI : 10.1016/j.diin.2009.06.009
A comparative methodology for the reconstruction of digital events using windows restore points, Digital Investigation, pp.8-15, 2009. ,
DOI : 10.1016/j.diin.2009.02.004