Appendix 3 - References

1. Magic number (programming). Wikipedia. [Online] http://en.wikipedia.org/wiki/Magic_number_(programming).

2. Carrier, Brian. File System Forensic Analysis. s.l. : Addison Wesley Professional, 2005.

3. Forensiks Wiki. Forensics Wiki. AFF. [Online] [Cited: Mar 29, 2011.] http://www.forensicswiki.org/wiki/AFF.

4. Bunting, Steve and Wei, William. The Official EnCE EnCase Certified Examiner Study Guide. Indianapolis IN : Wiley Publishing, Inc., 2006.

5. United States Computer Emergency Readiness Team. US-CERT Vulnerability Note VU#836068. US-CERT: United States Computer Emergency Readiness Team. [Online] [Cited: March 5, 2011.] http://www.kb.cert.org/vuls/id/836068.

6. Xiaoyun Wang, Yiqun Lisa Yin, Hongbo Yu. Collision Search Attacks on SHA1. 2005.

7. Merritt, Rick. Chinese researchers compromise SHA-1 hashing algorithm. EE Times. [Online] 2 16, 2005. [Cited: May 4, 2100.] http://www.eetimes.com/electronics-news/4051745/Chinese-researchers-compromise-SHA-1-hashing-algorithm.

8. Injosoft AB. ASCII Code - The extended ASCII table. http://www.injosoft.se/. [Online] http://www.ascii-code.com/.

9. Microsoft MSDN. http://msdn.microsoft.com/en-us/library. [Online] http://msdn.microsoft.com/en-us/library/cc231989%28PROT.13%29.aspx.

10. Hidden Disk Areas: HPA and DCO. Gupta, Mayank R., Hoeschele, Michael D. and Rogers, Marcus K. Fall 2006, Volume 5, Issue 1, International Journal of Digital Evidence.

11. Automated mapping of large binary objects using primitive fragment type classification. Conti, Gregory, et al., et al. 2010, Digital Investigation, Vol. 7S, pp. S3-S12.

12. Fileprints: Identifying file types by n-gram analysis. W. Li, K. Wang, S. Stolfo and B. Herzog. West Point, NY : s.n., June, 2005. 6th IEEE Information Assurance Workshop.

13. Wikipedia. Regular Expression. [Online] en.wikipedia.org/wiki?Regular_expression.

14. Microsoft. Windows registry information for advanced users. Article ID: 256986 - Revision: 12.3. [Online] February 4, 2008. [Cited: August 19, 2011.] http://support.microsoft.com/kb/256986.

15. Wikipedia. Windows Registry. Wikipedia - List of standard registry value types. [Online] [Cited: December 27, 2011.] http://en.wikipedia.org/wiki/Windows_Registry.

16. The Windows Registry as a forensic resource. Carvey, Harlan. 3, September 2005, Pages 201-205 , Digital Investigation, Vol. 2, pp. 201-205.

17. Access Data Inc. Registry Quick Find Chart. Access Data. [Online] 2005. [Cited: August 19, 2011.] http://accessdata.com/media/en_us/print/papers/wp.Registry_Quick_Find_Chart.en_us.pdf.

18. Time and date issues in forensic computing--a case study. Boyd, Chris and Foster, Pete. 1, February 2004, Digital Investigation, Vol. 1, pp. 18-23.

19. Jones, Keith J, Bejtlich, Richard and Rose, Curtis W. Real Digital Forensics Computer Security and Incident Response. s.l. : Addison-Wesley, 2006.

20. Mederios, Jason. NTFS Forensics: A Programmers View of Raw Filesystem Data Extraction. s.l. : Grayscale Research, 2008.

21. Russon, Richard. Linux NTFS Project: NTFS Documentation. Sourceforge.net. [Online] 1996 - 2004. [Cited: March 16, 2011.] http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/.

22. MBR is damaged - www.NTFS.com. NTFS.com. [Online] http://www.ntfs.com/mbr-damaged.htm.

23. Microsoft. Microsoft Extensible Firmware Initiative FAT32 File System Specification. FAT: General Overview of On-Disk Format. s.l. : Microsoft, 2000.

24. Stoffregen, Paul. Understanding FAT32 Filesystems. PJRC. [Online] Feb 24, 2005. [Cited: March 18, 2011.] http://www.pjrc.com/tech/8051/ide/fat32.html.

25. Microsoft. Detailed Explanation of FAT Boot Sector. support.microsoft.com. [Online] Article ID: 140418 - Last Review: December 6, 2003 - Revision: 3.0, December 6, 2003. http://support.microsoft.com/kb/140418.

26. —. Windows and GPT FAQ. Microsoft Developers Netword (MSDN). [Online] July 2008. http://msdn.microsoft.com/en-us/windows/hardware/gg463525.aspx.

27. —. Basic Storage Versus Dynamic Storage in Windows XP. Microsoft Support. [Online] December 1, 2007. [Cited: March 23, 2011.] http://support.microsoft.com/kb/314343.

28. National Institute of Standards and Technology. CFTT Project Overview. Computer Forensics Tool Testing Program. [Online] [Cited: March 28, 2011.] http://www.cftt.nist.gov/disk_imaging.htm.

29. Wikipedia - Host Protected Area. http://en.wikipedia.org/wiki/Host_protected_area. [Online] [Cited: Mar 29, 3011.] http://en.wikipedia.org/wiki/Host_protected_area.

30. Apple Computer, Inc. Technical Note TN2166 - Secrets of the GPT. developer.apple.com. [Online] 11 6, 2006. [Cited: April 5, 2011.] http://developer.apple.com/library/mac/#technotes/tn2166/_index.html .

31. Apple Inc. Inside Macintosh: Files. Reading, Massachusetts : Addison-Wesley, August 1992.

32. Apple, Inc. HFS Plus Volume Format - Technical Note TN1150. developer.apple.com. [Online] March 5, 2004. [Cited: April 6, 2011.] http://developer.apple.com/library/mac/#technotes/tn/tn1150.html.

33. Wikipedia: Extent (file systems). Extent (file systems). Wikipedia: Extent (file systems). [Online] [Cited: 4 6, 2011.] http://en.wikipedia.org/wiki/Extent_(file_systems).

34. Aomei Technology, Co., Ltd. What is a Dynamic Disk? Dynamic Disk. [Online] 2009. [Cited: April 13, 2011.] http://www.dynamic-disk.com/what-is-dynamic-disk.html.

35. Lewis, Don L. The Hash Algorithm Dilemma–Hash Value Collisions. Forensic Magazine. [Online] 2009. [Cited: May 2011, 4.] http://www.forensicmag.com/article/hash-algorithm-dilemma%E2%80%93hash-value-collisions?page=0,0.

36. An Empirical Analysis of Disk Sector Hashes for Data Carving. Yoginder Singh Dandass, Nathan Joseph Necaise, Sherry Reede Thomas. 2008, Journal of Digital Forensic Practice, Vol. 2, pp. 95-104.

37. Inc., Guidance Software. EnCase Forensic Version 6.10 User Manual. s.l. : Guidance Software, 2008.