F. Buchholz and C. Falk, Design and implementation of Zeitline: A forensic timeline, Digital Investigation, pp.78-87, 2005.

H. Carvey, Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry, 2016.

A. Case, A. Cristina, L. Marziale, G. Richard, and V. Roussev, FACE: Automated digital evidence discovery and correlation, Digital Investigation, pp.65-75, 2008.
DOI : 10.1016/j.diin.2008.05.008
URL : http://www.cs.uno.edu/~golden/Stuff/dfrws2008.pdf

K. Gudjonsson, Mastering the super timeline with log2timeline (www.sans.org/reading-room/whitepapers/logging/mast ering-super-timeline-log2timeline-33438), 2010.

C. Hargreaves and J. Patterson, An automated timeline reconstruction approach for digital forensic investigations, Digital Investigations, pp.69-79, 2012.
DOI : 10.1016/j.diin.2012.05.006

C. Jensen, H. Lonsdale, E. Wynn, J. Cao, M. Slater et al., The life and times of files and information, Proceedings of the 28th international conference on Human factors in computing systems, CHI '10, pp.767-776, 2010.
DOI : 10.1145/1753326.1753439

G. Lenik, I'm your MAC(b) daddy, presented at DEF CON 19, 2011.

D. Margo and R. Smogor, Using provenance to extract semantic file attributes, Proceedings of the Second Conference on Theory and Practice of Provenance, 2010.

K. Muniswamy-reddy, D. Holland, U. Braun, and M. Seltzer, Provenance-aware storage systems, Proceedings of the USENIX Annual Technical Conference, 2006.

B. Shavers, RegRipper (brettshavers.cc/index, p.2015

S. Sultana and E. Bertino, A file provenance system, Proceedings of the third ACM conference on Data and application security and privacy, CODASPY '13, pp.153-156, 2013.
DOI : 10.1145/2435349.2435368

E. Zadok and I. Badulescu, A stackable filesystem interface for Linux, Proceedings of the LinuxExpo Conference, pp.141-151, 1999.