I. Ahmed, K. Lhee, H. Shin, and M. Hong, On improving the accuracy and performance of content-based file type identification, Proceedings of the Fourteenth Australasian Conference on Information Security and Privacy, pp.44-59, 2009.

S. Axelsson, The normalized compression distance as a file fragment classifier, Digital Investigation, vol.7, pp.24-31, 2010.

S. Axelsson, Using normalized compression distance for classifying file fragments, Proceedings of the International Conference on Availability, Reliability and Security, pp.641-646, 2010.

S. Axelsson, K. Bajwa, and M. Srikanth, File fragment analysis using normalized compression distance, Advances in Digital Forensics IX, pp.171-182, 2013.
URL : https://hal.archives-ouvertes.fr/hal-01460604

J. Barbara, Solid state drives: Part 5, Forensic Magazine, vol.11, pp.30-31, 2014.

F. Breitinger and K. Petrov, Reducing the time required for hashing operations, Advances in Digital Forensics IX, pp.101-117, 2013.
URL : https://hal.archives-ouvertes.fr/hal-01460624

F. Breitinger, C. Rathgeb, and H. Baier, An efficient similarity digests database lookup -A logarithmic divide and conquer approach, Journal of Digital Forensics, Security and Law, vol.9, issue.2, pp.155-166, 2014.

F. Breitinger, G. Stivaktakis, and H. Baier, FRASH: A framework to test algorithms of similarity hashing, Digital Investigation, vol.10, pp.50-58, 2013.

C. Buckel, Understanding Flash: Blocks, Pages and Program Erases, flashdba Blog (flashdba.com/2014/06/20/understand ing-flash-blocks-pages-and-program-erases), 2014.

C. Buckel, Understanding Flash: The Flash Translation Layer, flashdba Blog (flashdba.com/2014/09/17/understanding-flash -the-flash-translation-layer), 2014.

W. Calhoun and D. Coles, Predicting the types of file fragments, Digital Investigation, vol.5, pp.14-20, 2008.

B. Carrier, File System Forensic Analysis, Pearson Education, 2005.

B. Carrier, TSK Tool Overview (wiki.sleuthkit.org/index. php?title=TSK_Tool_Overview), 2014.

T. Chung, D. Park, S. Park, D. Lee, S. Lee et al., A survey of the flash translation layer, Journal of Systems Architecture, vol.55, pp.332-343, 2009.

S. Collange, Y. Dandass, M. Daumas, and D. Defour, Using graphics processors for parallelizing hash-based data carving, Proceedings of the Forty-Second Hawaii International Conference on System Sciences, 2009.
URL : https://hal.archives-ouvertes.fr/hal-00350962

, Cryptology Group at Centrum Wiskunde and Informatica and Security, Privacy and Anti-Abuse Group at Google Research, SHAttered -We have Broken SHA-1 in Practice, p.2017

Y. Dandass, N. Necaise, and S. Thomas, An empirical analysis of disk sector hashes for data carving, Journal of Digital Forensic Practice, vol.2, issue.2, pp.95-104, 2008.

, Real Data Corpus (digitalcorpora.org/cor pora/disk-images/real-data-corpus), Digital Corpora, 2018.

, European Police Office, IOCTA 2016: Internet Organized Crime Threat Assessment, 2016.

K. Fairbanks, An analysis of Ext4 for digital forensics, Digital Investigation, vol.9, pp.118-130, 2012.

K. Fairbanks, A technique for measuring data persistence using the Ext4 file system journal, Proceedings of the Thirty-Ninth Annual IEEE Computer Software and Applications Conference, vol.3, pp.18-23, 2015.

K. Fairbanks and S. Garfinkel, Column: Factors affecting data decay, Journal of Digital Forensics, Security and Law, vol.7, issue.2, pp.7-10, 2012.

S. Fitzgerald, G. Mathews, C. Morris, and O. Zhulyn, Using NLP techniques for file fragment classification, Digital Investigation, vol.9, pp.44-49, 2012.

K. Foster, Using Distinct Sectors in Media Sampling and Full Media Analysis to Detect Presence of Documents from a Corpus, 2012.

S. Garfinkel and M. Mccarrin, Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb, Digital Investigation, vol.14, issue.S1, pp.95-105, 2015.

S. Garfinkel, A. Nelson, D. White, and V. Roussev, Using purposebuilt functions and block hashes to enable small block and sub-file forensics, Digital Investigation, vol.7, pp.13-23, 2010.

S. Gibbs, From Windows 1 to Windows 10: 29 years of Windows evolution, The Guardian, 2014.

P. Gladyshev and J. James, Decision-theoretic file carving, Digital Investigation, vol.22, pp.46-61, 2017.

Y. Gubanov and O. Afonin, Why SSD drives destroy court evidence and what can be done about it, Forensic Focus, 2012.

Y. Gubanov and O. Afonin, Recovering evidence from SSD drives in 2014: Understanding trim, garbage collection and exclusions, Forensic Focus, 2014.

Y. Gubanov and O. Afonin, SSD and eMMC forensics 2016, Forensic Focus, 2016.

Y. Gubanov and O. Afonin, SSD and eMMC forensics 2016 -Part 2, Forensic Focus, 2016.

Y. Gubanov and O. Afonin, SSD and eMMC forensics 2016 -Part 3, Forensic Focus, 2016.

, Guidance Software, File Block Hash Map Analysis, Version 8.8.5, Waterloo, Canada (www.guidancesoftware.com/app/File-Block-Hash-Map-Analysis), 2018.

J. Jones, T. Khan, K. Laskey, A. Nelson, M. Laamanen et al., Inferring previously uninstalled applications from residual partial artifacts, Proceedings of the Eleventh Annual Conference on Digital Forensics, Security and Law, pp.113-130, 2016.

M. Karresand, Completing the Picture -Fragments and Back Again, 2008.

M. Karresand and N. Shahmehri, File type identification of data fragments by their binary structure, Proceedings of the Seventh Annual IEEE SMC Information Assurance Workshop, pp.140-147, 2006.

M. Karresand and N. Shahmehri, Oscar -File type and camera identification using the structure of binary data fragments, Proceedings of the First Conference on Advances in Computer Security and Forensics, pp.11-20, 2006.

M. Karresand and N. Shahmehri, Oscar -File type identification of binary data in disk clusters and RAM pages, Proceedings of the Thirty-First IFIP TC-11 International Information Security Conference, pp.413-424, 2006.

M. Karresand and N. Shahmehri, Oscar -Using byte pairs to find the file type and camera make of data fragments, Proceedings of the Second European Conference on Computer Network Defense, pp.85-94, 2007.

M. Karresand and N. Shahmehri, Reassembly of fragmented JPEG images containing restart markers, Proceedings of the Fourth European Conference on Computer Network Defense, pp.25-32, 2008.

J. Kornblum, Identifying almost identical files using context triggered piecewise hashing, Digital Investigation, vol.3, pp.91-97, 2006.

Q. Li, A. Ong, P. Suganthan, and V. Thing, A novel support vector machine approach to high entropy data fragment classification, Proceedings of the South African Information Security Multi-Conference, pp.236-247, 2010.

, LSoft Technologies, NTFS Partition Boot Sector, Mississauga, Canada (www.ntfs.com/ntfs-partition-boot-sector. htm), 2018.

. Microsoft, Windows 7 System Requirements, Redmond, Washington, 2017.

. Microsoft, Windows 8.1 System Requirements, Redmond, Washington (support.microsoft.com/en-gb/help/12660/windows-8-sy stem-requirements), 2017.

. Microsoft, Windows 10 System Requirements, Redmond, Washington (support.microsoft, help/4028142/windows-wi ndows-10-system-requirements), 2017.

D. Microsoft, N. Cluster-size-for, and W. Redmond, , 2018.

. Microsoft, N. How, . Works, and W. Redmond, ).aspx), October 28, 2018.

, Desktop Operating System Market Share, 2017.

A. Pal and N. Memon, The evolution of file carving, IEEE Signal Processing, vol.26, issue.2, pp.59-71, 2009.

R. Poisel, M. Rybnicek, and S. Tjoa, Taxonomy of data fragment classification techniques, pp.67-85, 2014.

R. Poisel and S. Tjoa, A comprehensive literature review of file carving, Proceedings of the International Conference on Availability, Reliability and Security, pp.475-484, 2013.

D. Quick and K. Choo, Data reduction and data mining framework for digital forensic evidence: Storage, intelligence, review and archive, Trends and Issues in Crime and Criminal Justice, pp.1-11, 2014.

D. Quick and K. Choo, Impacts of increasing volume of digital forensic data: A survey and future research challenges, Digital Investigation, vol.11, issue.4, pp.273-294, 2014.

D. Quick and K. Choo, Big forensic data reduction: Digital forensic images and electronic evidence, Cluster Computing, vol.19, issue.2, pp.723-740, 2016.

R. Reiter, T. Swatosh, P. Hempstead, and M. Hicken, Accessing logical-to-physical address translation data for solid state disks, 2014.

V. Roussev, Managing terabyte-scale investigations with similarity digests, Advances in Digital Forensics VIII, pp.19-34, 2012.
URL : https://hal.archives-ouvertes.fr/hal-01523709

N. Rowe, Identifying forensically uninteresting files using a large corpus, Digital Forensics and Cyber Crime, pp.86-101, 2014.

B. Schneier, Applied Cryptography: Protocols, Algorithms and Source Code in C, 1996.

M. Stevens, E. Bursztein, P. Karpman, A. Albertini, and Y. Markov, The first collision for full SHA-1, Proceedings of the Thirty-Seventh Annual International Cryptology Conference, pp.570-596, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01982005

A. , , 2015.

R. Van-baar, H. Van-beek, and E. Van-eijk, Digital forensics as a service: A game changer, Digital Investigation, vol.11, issue.S1, pp.54-62, 2014.

H. Van-beek, E. Van-eijk, R. Van-baar, M. Ugen, J. Bodde et al., Digital forensics as a service: Game on, Digital Investigation, vol.15, pp.20-38, 2015.

C. Veenman, Statistical disk cluster classification for file carving, Proceedings of the Third International Symposium on Information Assurance and Security, pp.393-398, 2007.

J. Young, K. Foster, S. Garfinkel, and K. Fairbanks, Distinct sector hashes for target file detection, IEEE Computer, vol.45, issue.12, pp.28-35, 2012.