| Paper | Presentation | Conference | Downloads | Author |
|---|---|---|---|
| Recovering Deleted Data From the Windows Registry | DFRWS USA 2008 | Timothy D. Morgan (VSR Investigations) | |
| Limewire Examinations | DFRWS USA 2008 | Joseph Lewthwaite (Defense Cyber Crime Institute, USA), Victoria Smith (Department of Defense, USA) | |
| Forensic Memory Analysis – Files Mapped In Memory | DFRWS USA 2008 | R.B. van Baar (Netherlands Forensic Institute), W. Alink (Netherlands Forensic Institute), A.R. van Ballegooij (Netherlands Forensic Institute) | |
| Forensic Analysis of the Windows Registry in Memory | DFRWS USA 2008 | Brendan Dolan-Gavitt (MITRE Corporation) | |
| Detecting File Fragmentation Point Using Sequential Hypothesis Testing | DFRWS USA 2008 | AnanAnandabrata Pal (Polytechnic University, Brooklyn), Husrev T. Sencar (Polytechnic University, Brooklyn), Nasir Memon (Polytechnic University, Brooklyn) | |
| An Overall Assessment Of Mobile Internal Acquisition Tool | DFRWS USA 2008 | Alessandro Distefano (University of Rome), Gianluigi Me (University of Rome) | |
| Validation And Verification Of Computer Forensic Software Tools-Searching Function | DFRWS USA 2009 | Yinghua Guo, Jill Slay (La Trobe University), and Jason Beckett | |
| Using ShellBag Information to Reconstruct User Activities | DFRWS USA 2009 | Yuandong Zhu, Pavel Gladyshev, Ph.D. (University College Dublin), and Joshua James (University College Dublin) | |
| Extraction of Forensically Sensitive Information from Windows Physical Memory | DFRWS USA 2009 | Seyed Mahmood Hejazi, Chamseddine Talhi, and Mourad Debbabi (Concordia University) | |
| Digital Forensic Implications of ZFS | DFRWS USA 2009 | Nicole Beebe, Ph.D. (UTSA), Sonia Mandes, and Dane Stuckey | |
| A Second Generation Computer Forensic Analysis System | DFRWS USA 2009 | Daniel Ayers | |
| A Novel Time-Memory Trade-Off Method for Password Recovery | DFRWS USA 2009 | Hwei-Ming Ying | |
| The Persistence of Memory РForensic Identification and Extraction of Cryptographic Keys | DFRWS USA 2009 | Carsten Maartmann-Moe, André Årnes (Norwegian University of Technology and Science), Steffen Thorkildsen | |
| Teleporter – An Analytically and Forensically Sound Duplicate Transfer System | DFRWS USA 2009 | Kathryn Watkins, Mike McWhorter, Jeff Long, William Hill | |
| Lessons Learned from the Construction of a Korean Software Reference Data Set for Digital Forensics | DFRWS USA 2009 | Sangseo Park, Cheolwon Lee, Sungjai Baek | |
| Identification and Recovery of JPEG Files with Missing Fragments | DFRWS USA 2009 | Husrev Sencar, Nasir Memon (NYU Tandon School of Engineering) | |
| Extending the Advanced Forensic Format to accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow | DFRWS USA 2009 | Michael Cohen (Google), Simson Garfinkel, Ph.D. (U.S. Census Bureau), Bradley Schatz, Ph.D. (Schatz Forensic) | |
| DIALOG – A Framework for Modeling, Analysis and Reuse of Digital Forensic Knowledge | DFRWS USA 2009 | Damir Kahvedzic, Tahar Kechadi | |
| DEX – Digital Evidence Provenance Supporting Reproducibility and Comparison | DFRWS USA 2009 | Brian Levine (University of Massachusetts Amherst), Marc Liberatore (University of Massachusetts Amherst) | |
| Computer Forensic Timeline Visualization Tool | DFRWS USA 2009 | Jens Olsson, Martin Boldt | |
| Bringing Science to Digital Forensics with Standardized Forensic Corpora | DFRWS USA 2009 | Simson Garfinkel, Ph.D. (U.S. Census Bureau), Paul Farrell, Vassil Roussev, Ph.D. (University of New Orleans), George Dinolt | |
| Windows Operating System Agnostic Memory Analysis | DFRWS USA 2010 | James Okolica and Gilbert Peterson (US Air Force Institute of Technology) | |
| Using Purpose-Built Functions And Block Hashes To Enable Small Block And Sub-File Forensics | DFRWS USA 2010 | Simson Garfinkel, Ph.D. (Naval Postgraduate School), Alex Nelson, Ph.D. (Naval Postgraduate School), Douglas White (NIST), and Vassil Roussev, Ph.D. (University of New Orleans) | |
| Secure USB Bypassing Tool | DFRWS USA 2010 | Jewan Bang, Byeongyeong Yoo, and Sangjin Lee | |
| Live Memory Forensics of Mobile Phones | DFRWS USA 2010 | Vrizlynn L. L. Thing, Kian-Yong Ng, AND Ee-Chien Chang | |
| Extracting Windows Command Line Details from Physical Memory | DFRWS USA 2010 | Richard Stevens and Eoghan Casey, Ph.D. (cmdLabs) | |
| Digital Forensics Research – The Next 10 Years | DFRWS USA 2010 | Simson Garfinkel, Ph.D. (Naval Postgraduate School) | |
| Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation | DFRWS USA 2010 | Golden Richard III, Ph.D. (Louisiana State University), Andrew Case (Volexity), Lodovico Marziale (BlackBag Technologies), Cris Neckar | |
| The Normalized Compression Distance as a File Fragment Classifier | DFRWS USA 2010 | Stefan Axelsson (Norwegian University of Science and Technology) | |
| Leaving Timing Channel Fingerprints in Hidden Service Log Files | DFRWS USA 2010 | Bilal Shebaro, Fernando Perez-Gonzalez (Universidad de Vigo), Jedidiah Crandall (University of New Mexico) | |
| If Error Rate is Such a Simple Concept, Why Don’t I have One for My Forensic Tool Yet | DFRWS USA 2010 | James Lyle | |
| Hash Based Disk Imaging Using AFF4 | DFRWS USA 2010 | Michael Cohen (Google), Bradley Schatz, Ph.D. (Schatz Forensic) | |
| Forensic Investigation of Peer-to-Peer File Sharing Network | DFRWS USA 2010 | Robert Erdely, Thomas Kerle, Brian Levine (University of Massachusetts Amherst), Marc Liberatore (University of Massachusetts Amherst), Clay Shields (Georgetown University) | |
| Dynamic Recreation of Kernel Data Structures for Live Forensics | DFRWS USA 2010 | Golden Richard III, Ph.D. (Louisiana State University), Andrew Case (Volexity), Lodovico Marziale (BlackBag Technologies) | |
| Different Interpretations of ISO9660 File Systems | DFRWS USA 2010 | Brian Carrier (Honorary Board Member) , Ph.D. (Basis Technology) | |
| Automated Mapping of Large Binary Objects Using Primitive Fragment Type Classification | DFRWS USA 2010 | Gregory Conti, Sergey Bratus, Benjamin Sangster, Roy Ragsdale, Matthew Supan, Andrew Lichtenberg, Robert Perez-Alemany, Anna Shubina | |
| Android Anti-Forensics Through a Local Paradigm | DFRWS USA 2010 | Alessandro Distefano, Gianluigi Me, Francesco Pace | |
| Visualization in Testing a Volatile Memory Forensic Tool | DFRWS USA 2011 | Hajime Inoue, Frank Adelstein, Ph.D. (ATC-NY Corp), Robert Joyce | |
| Towards a General Collection Methodology for Android Devices | DFRWS USA 2011 | Chengye Zhang and Nicolas Christin | |
| Forensic Carving of Network Packets and Associated Data Structures | DFRWS USA 2011 | Robert Beverly, Ph.D. (Naval Postgraduate School), Simson Garfinkel, Ph.D. (Naval Postgraduate School), and Greg Cardwell | |
| Augmenting Password Recovery with Online Profiling | DFRWS USA 2011 | Khawla Al-Wehaibi, Tim Storer, and Brad Glisson | |
| Advanced Evidence Collection and Analysis of Web Browser Activity | DFRWS USA 2011 | Junghoon Oh, Seungbong Lee, and Sangjin Lee | |
| System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence | DFRWS USA 2011 | Clay Shields (Georgetown University), Ophir Frieder, Mark Maloof | |
| Reconstructing Corrupt DEFLATEd Files | DFRWS USA 2011 | Ralf Brown (CMU) | |
| Privacy-Preserving Network Flow Recording | DFRWS USA 2011 | Bilal Shebaro, Jedidiah Crandall (University of New Mexico) | |
| Extracting the Windows Clipboard from Memory | DFRWS USA 2011 | James Okolica, Gilbert Peterson (US Air Force Institute of Technology) | |
| Empirical Analysis of Solid State Disk Data Retention when used with Contemporary Operating Systems | DFRWS USA 2011 | Christopher King | |
| eDiscovery Case Study | DFRWS USA 2011 | A. J. Krouse | |
| Distributed Forensics and Incident Response in the Enterprise | DFRWS USA 2011 | Michael Cohen (Google), Darren Bilby, Germano Caronni | |
| Digital Forensics in Consumer Online Privacy Class Actions | DFRWS USA 2011 | Scott Kamber |