E-Discovery and Digital Forensics Papers

Recent Books and Book Chapters on Digital Forensics:

• Digital Forensic Evidence Examination 2013 Ed.
• Challenges to Digital Forensic Evidence 2010 Ed.
• Digital Forensic Evidence Examination 2nd Ed.
• Fundamentals of Digital Forensic Evidence (Chapter in Handbook of Information and Communication Security)
• Digital Forensic Evidence Examination - Sample Chapter
• Challenges to Digital Forensic Evidence

Recent Peer Reviewed Articles on Digital Forensics:

• 2015-12-26 IFIP 2016 Pre-final: Generalizations to Travel Time Consistency Checking
• 2015-01-26 A Tale of Two Traces - Paper
• 2015-01-26 A Tale of Two Traces - Slide Deck
• Time and Space Interval Record Schedule Consistency Analysis for Atomic Items without Interactions in Open Spaces with Stationary Locations
• A note on recovery of data from overwritten areas of magnetic media
• 2012-09-21 The Future of Digital Forensics - 1st Chinese Conf. on Digital Forensics - As Published
• The Future of Digital Forensics, 1st Chinese Conference on Digital Forensics Keynote Address
• 2012-05-30 Update on the State of the Science of Digital Evidence Examination
• 2012-05-25 Forensic Methods for Detecting Insider Turning Behaviors - IEEE WRIT (paper)
• The Physics of Digital Information (part 2) (JDFSL)
• The Physics of Digital Information (part 1) (JDFSL)
• Putting the Science in Digital Forensics (JDFSL)
• Putting the Science in Digital Forensics (JDFSL)
• The State of the Science of Digital Evidence Examination (IFIP)
• A Method for Forensic Analysis of Control (Computers & Security - 2010)
• Fonts for Forensics (IEEE SADFE-2010)
• Analysis of redundant traces for consistency (IEEE CFSE 2009)
• Two models of digital forensic examination (IEEE SADFE-2009)
• Issues and a Case Study in Bulk Email Forensics (IFIP 2009)
• A Ph.D. Curriculum for Digital Forensics (HICSS 2008)
• A Method for Recovering Data From Failing Floppy Disks with a Practical Example (IFIP 2008)

Recent Analyst Reports on Digital Forensics:

• 2010-08 - The DMCA Still Restricts Forensics
• 2010-07 - Mediated Investigative Electronic Discovery
• Legal Update - Selections from a periodic mailer
• 2009-12 - COFEE and the state of digital forensics
• 2009-09 - The limits of my tools, my techniques, and myself
• 2009-07 - The speed of light, it's easy to forge, email is always fast, and more
• 2009-02 - Digital forensics must come of age
• 2009-02 - A structure for addressing digital forensics

Recent Slides and Presentations on Digital Forensics:

• 2013-05-22 Building a new scientific theory and practice of digital forensics - 1st International Summit of Digital Forensics Keynote Address
• 2012-09-21 The Future of Digital Forensics - 1st Chinese Conf. on Digital Forensics - Talk
• 2012-05-25 Forensic Methods for Detecting Insider Turning Behaviors - IEEE WRIT (slides)
• 2011-02-14 MiniMetriCon: How to Tell When an Insider is About to Go Bad
• 2011-02-14 MiniMetriCon: Metrics for Digital Forensics
• 2011-01-31 - IFIP Slides: The State of the Science of Digital Evidence Examination
• 2010-11-02 - The physics of digital information and its application to digital forensics
• 2010-11-01 - Keynote - Where do enterprise protection and digital forensics converge? AND Where do they diverge?
• 2010-09-14 NeFX Workshop - Digital Forensic Evidence Examination - The State of the Science - and Where to Go From Here
• 2010-08-19 - Recent and Hoped for Advances in Digital Forensics
• 2010-05 - Forensic Fonts
• 2010-01 - Attribution of Messages to Sources in Digital Forensics
• 2010-01 - The Science of DFE Examination (IFIP) - The Paper
• 2010-01 - The Science of DFE Examination (IFIP) - The Slide Set
• 2009-08 - What You See is NOT What You Get (HTCIA)
• 2009-08 Challenges to Digital Forensic Evidence (HTCIA)
• 2009-08 - Bulk Email Forensics (HTCIA)
• 2009-07 - Analysis of Redundant Traces for Consistency (IEEE CFSE)
• 2009-05 Two Models of Digital Forensic Examination (IEEE SADFE)
• The Physics of Digital Information Systems (IEEE Oakland 5-minute presentation)
• 2009-01 - Bulk Email Forensics (IFIP conference)
• 2008-04 - Metrics for Digital Forensics (Minimetricon)
• 2008-01 - A Method for Recovering Data from Failing Floppy Disks with a Practical Example
• 2007-04 - Floppy Forensics (guest lecture to students at USC)