H. Carvey, Windows Forensic Analysis, 2007.

M. Geiger and F. Cranor, Counter-Forensic Privacy Tools: A Forensic Evaluation, isri20 05/CMU-ISRI-05-119.pdf), 2005.
DOI : 10.1109/msp.2006.132

P. Gladyshev and A. Enbacka, Rigorous development of automated inconsistency checks for digital evidence using the B method, International Journal of Digital Evidence, vol.6, issue.2, pp.1-21, 2007.

P. Gladyshev and A. Patel, Formalizing event time bounding in digital investigations, International Journal of Digital Evidence, vol.4, issue.2, pp.1-14, 2005.

S. Hilley, Anti-forensics with a small army of exploits, Digital Investigation, pp.13-15, 2007.
DOI : 10.1016/j.diin.2007.01.005

S. Willassen, Hypothesis-based investigation of digital timestamps, in Advances in Digital Forensics IV, I, pp.75-86, 2008.

Y. Zhu, P. Gladyshev, and J. James, Using shellbag information to reconstruct user activities, Digital Investigation, pp.69-77, 2009.
DOI : 10.1016/j.diin.2009.06.009

Y. Zhu, J. James, and P. Gladyshev, A comparative methodology for the reconstruction of digital events using windows restore points, Digital Investigation, pp.8-15, 2009.
DOI : 10.1016/j.diin.2009.02.004