On improving the accuracy and performance of content-based file type identification, Proceedings of the Fourteenth Australasian Conference on Information Security and Privacy, pp.44-59, 2009. ,
The normalized compression distance as a file fragment classifier, Digital Investigation, vol.7, pp.24-31, 2010. ,
Using normalized compression distance for classifying file fragments, Proceedings of the International Conference on Availability, Reliability and Security, pp.641-646, 2010. ,
File fragment analysis using normalized compression distance, Advances in Digital Forensics IX, pp.171-182, 2013. ,
URL : https://hal.archives-ouvertes.fr/hal-01460604
Solid state drives: Part 5, Forensic Magazine, vol.11, pp.30-31, 2014. ,
Reducing the time required for hashing operations, Advances in Digital Forensics IX, pp.101-117, 2013. ,
URL : https://hal.archives-ouvertes.fr/hal-01460624
An efficient similarity digests database lookup -A logarithmic divide and conquer approach, Journal of Digital Forensics, Security and Law, vol.9, issue.2, pp.155-166, 2014. ,
FRASH: A framework to test algorithms of similarity hashing, Digital Investigation, vol.10, pp.50-58, 2013. ,
Understanding Flash: Blocks, Pages and Program Erases, flashdba Blog (flashdba.com/2014/06/20/understand ing-flash-blocks-pages-and-program-erases), 2014. ,
Understanding Flash: The Flash Translation Layer, flashdba Blog (flashdba.com/2014/09/17/understanding-flash -the-flash-translation-layer), 2014. ,
Predicting the types of file fragments, Digital Investigation, vol.5, pp.14-20, 2008. ,
File System Forensic Analysis, Pearson Education, 2005. ,
TSK Tool Overview (wiki.sleuthkit.org/index. php?title=TSK_Tool_Overview), 2014. ,
A survey of the flash translation layer, Journal of Systems Architecture, vol.55, pp.332-343, 2009. ,
Using graphics processors for parallelizing hash-based data carving, Proceedings of the Forty-Second Hawaii International Conference on System Sciences, 2009. ,
URL : https://hal.archives-ouvertes.fr/hal-00350962
, Cryptology Group at Centrum Wiskunde and Informatica and Security, Privacy and Anti-Abuse Group at Google Research, SHAttered -We have Broken SHA-1 in Practice, p.2017
An empirical analysis of disk sector hashes for data carving, Journal of Digital Forensic Practice, vol.2, issue.2, pp.95-104, 2008. ,
, Real Data Corpus (digitalcorpora.org/cor pora/disk-images/real-data-corpus), Digital Corpora, 2018.
, European Police Office, IOCTA 2016: Internet Organized Crime Threat Assessment, 2016.
An analysis of Ext4 for digital forensics, Digital Investigation, vol.9, pp.118-130, 2012. ,
A technique for measuring data persistence using the Ext4 file system journal, Proceedings of the Thirty-Ninth Annual IEEE Computer Software and Applications Conference, vol.3, pp.18-23, 2015. ,
Column: Factors affecting data decay, Journal of Digital Forensics, Security and Law, vol.7, issue.2, pp.7-10, 2012. ,
Using NLP techniques for file fragment classification, Digital Investigation, vol.9, pp.44-49, 2012. ,
Using Distinct Sectors in Media Sampling and Full Media Analysis to Detect Presence of Documents from a Corpus, 2012. ,
Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb, Digital Investigation, vol.14, issue.S1, pp.95-105, 2015. ,
Using purposebuilt functions and block hashes to enable small block and sub-file forensics, Digital Investigation, vol.7, pp.13-23, 2010. ,
From Windows 1 to Windows 10: 29 years of Windows evolution, The Guardian, 2014. ,
Decision-theoretic file carving, Digital Investigation, vol.22, pp.46-61, 2017. ,
Why SSD drives destroy court evidence and what can be done about it, Forensic Focus, 2012. ,
Recovering evidence from SSD drives in 2014: Understanding trim, garbage collection and exclusions, Forensic Focus, 2014. ,
, SSD and eMMC forensics 2016, Forensic Focus, 2016.
, SSD and eMMC forensics 2016 -Part 2, Forensic Focus, 2016.
, SSD and eMMC forensics 2016 -Part 3, Forensic Focus, 2016.
, Guidance Software, File Block Hash Map Analysis, Version 8.8.5, Waterloo, Canada (www.guidancesoftware.com/app/File-Block-Hash-Map-Analysis), 2018.
Inferring previously uninstalled applications from residual partial artifacts, Proceedings of the Eleventh Annual Conference on Digital Forensics, Security and Law, pp.113-130, 2016. ,
Completing the Picture -Fragments and Back Again, 2008. ,
File type identification of data fragments by their binary structure, Proceedings of the Seventh Annual IEEE SMC Information Assurance Workshop, pp.140-147, 2006. ,
Oscar -File type and camera identification using the structure of binary data fragments, Proceedings of the First Conference on Advances in Computer Security and Forensics, pp.11-20, 2006. ,
Oscar -File type identification of binary data in disk clusters and RAM pages, Proceedings of the Thirty-First IFIP TC-11 International Information Security Conference, pp.413-424, 2006. ,
Oscar -Using byte pairs to find the file type and camera make of data fragments, Proceedings of the Second European Conference on Computer Network Defense, pp.85-94, 2007. ,
Reassembly of fragmented JPEG images containing restart markers, Proceedings of the Fourth European Conference on Computer Network Defense, pp.25-32, 2008. ,
Identifying almost identical files using context triggered piecewise hashing, Digital Investigation, vol.3, pp.91-97, 2006. ,
A novel support vector machine approach to high entropy data fragment classification, Proceedings of the South African Information Security Multi-Conference, pp.236-247, 2010. ,
, LSoft Technologies, NTFS Partition Boot Sector, Mississauga, Canada (www.ntfs.com/ntfs-partition-boot-sector. htm), 2018.
Windows 7 System Requirements, Redmond, Washington, 2017. ,
Windows 8.1 System Requirements, Redmond, Washington (support.microsoft.com/en-gb/help/12660/windows-8-sy stem-requirements), 2017. ,
Windows 10 System Requirements, Redmond, Washington (support.microsoft, help/4028142/windows-wi ndows-10-system-requirements), 2017. ,
, , 2018.
, ).aspx), October 28, 2018.
, Desktop Operating System Market Share, 2017.
The evolution of file carving, IEEE Signal Processing, vol.26, issue.2, pp.59-71, 2009. ,
Taxonomy of data fragment classification techniques, pp.67-85, 2014. ,
A comprehensive literature review of file carving, Proceedings of the International Conference on Availability, Reliability and Security, pp.475-484, 2013. ,
Data reduction and data mining framework for digital forensic evidence: Storage, intelligence, review and archive, Trends and Issues in Crime and Criminal Justice, pp.1-11, 2014. ,
Impacts of increasing volume of digital forensic data: A survey and future research challenges, Digital Investigation, vol.11, issue.4, pp.273-294, 2014. ,
Big forensic data reduction: Digital forensic images and electronic evidence, Cluster Computing, vol.19, issue.2, pp.723-740, 2016. ,
Accessing logical-to-physical address translation data for solid state disks, 2014. ,
Managing terabyte-scale investigations with similarity digests, Advances in Digital Forensics VIII, pp.19-34, 2012. ,
URL : https://hal.archives-ouvertes.fr/hal-01523709
Identifying forensically uninteresting files using a large corpus, Digital Forensics and Cyber Crime, pp.86-101, 2014. ,
Applied Cryptography: Protocols, Algorithms and Source Code in C, 1996. ,
The first collision for full SHA-1, Proceedings of the Thirty-Seventh Annual International Cryptology Conference, pp.570-596, 2017. ,
URL : https://hal.archives-ouvertes.fr/hal-01982005
, , 2015.
Digital forensics as a service: A game changer, Digital Investigation, vol.11, issue.S1, pp.54-62, 2014. ,
, Digital forensics as a service: Game on, Digital Investigation, vol.15, pp.20-38, 2015.
Statistical disk cluster classification for file carving, Proceedings of the Third International Symposium on Information Assurance and Security, pp.393-398, 2007. ,
Distinct sector hashes for target file detection, IEEE Computer, vol.45, issue.12, pp.28-35, 2012. ,