%%%%%%%%%Lit_review_SSD%%%%%%%%%

@article{S1_evolution,
author={Pal, Anandabrata and Memon, Nasir},
journal={IEEE Signal Processing Magazine}, 
title={The evolution of file carving}, 
year={2009},
volume={26},
number={2},
pages={59-71},
doi={10.1109/MSP.2008.931081}}

@article{S2_ssd_beginning,
title={Solid state drives: the beginning of the end for current practice in digital forensic recovery?},
author={Bell, Graeme B and Boddington, Richard},
journal={Journal of Digital Forensics, Security and Law},
volume={5},
number={3},
pages={1},
year={2010},
doi={https://doi.org/10.15394/jdfsl.2010.1078}
}

@phdthesis{S3_ssd_contruction,
author = {Yohannes, Fkrezgy and Zanero, Stefano},
title = {{Solid State Drive (SSD) Digital Forensics Construction}},
school = {Polytechnic University of Milan},
year = {2011}
}

@phdthesis{S4_for_invest_ssd,
author = {Ritola, Richard},
title = {{Forensic investigation of Solid State Drive}},
school = {Dalarna University},
year = {2012}
}

@inproceedings{S5_black_box,
author = {Bonetti, Gabriele and Viglione, Marco and Frossi, Alessandro and Maggi, Federico and Zanero, Stefano},
title = {A Comprehensive Black-Box Methodology for Testing the Forensic Characteristics of Solid-State Drives},
year = {2013},
isbn = {9781450320153},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2523649.2523660},
doi = {10.1145/2523649.2523660},
booktitle = {Proceedings of the 29th Annual Computer Security Applications Conference},
pages = {269–278},
numpages = {10},
location = {New Orleans, Louisiana, USA},
series = {ACSAC '13}
}

@inproceedings{S6_infer_rw,
author={Canclini, JonPaul and McMasters, James and Shey, James and Walker, Owens and Rakvic, Ryan and Ngo, Hau and Fairbanks, Kevin D.},
booktitle={2016 IEEE 7th Annual Ubiquitous Computing, Electronics and Mobile Communication Conference (UEMCON)}, 
title={Inferring read and write operations of solid-state drives based on energy consumption}, 
year={2016},
volume={},
number={},
pages={1-6},
doi={10.1109/UEMCON.2016.7777891}
}

@inproceedings{S7_for_ana_ssd,
title={Forensics analysis of solid state drive (SSD)},
author={Joshi, Binaya Raj and Hubbard, Rick},
booktitle={2016 Universal Technology Management Conference (UTMC)},
publisher = {The Society of Digital Information and Wireless Communications (SDIWC) Wilmington, New Castle, DE 19801, USA},
pages={1--12},
year={2016},
organization={researchgate. net}
}


@techreport{S8_ssd_new_chal,
author = {Marupudi, Shiva Sai Ram},
institution = {St. Cloud State University},
title = {{Solid State Drive: New Challenge for Forensic Investigation}},
type = {},
publisher = {}, 
url = {https://repository.stcloudstate.edu/msia_etds/30},
number = {},
year = {2017}
}

@inproceedings{S9_ssd_wl,
author={Neyaz, Ashar and Shashidhar, Narasimha and Karabiyik, Umit},
booktitle={2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)}, 
title={Forensic Analysis of Wear Leveling on Solid-State Media}, 
year={2018},
volume={},
number={},
pages={1706-1710},
doi={10.1109/TrustCom/BigDataSE.2018.00256}
}

@inproceedings{S10_side_channel,
author={Johnson, Zachary and Varon, Alex and Blanco, Justin and Rakvic, Ryan and Shey, James and Ngo, Hau and Brown, Dane and Walker, Owens},
booktitle={2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC/PiCom/DataCom/CyberSciTech)}, 
title={Classifying Solid State Drive Firmware via Side-Channel Current Draw Analysis}, 
year={2018},
volume={},
number={},
pages={943-948},
doi={10.1109/DASC/PiCom/DataCom/CyberSciTec.2018.000-5}
}
  

@article{S11_frozen_ssd,
author = {Riadi, Imam and Umar, Rusydi and Nasrulloh, Imam},
year = {2018},
month = {12},
pages = {169-181},
title = {Experimental Investigation of Frozen Solid State Drive on Digital Evidence with Static Forensic Methods},
volume = {9},
journal = {Lontar Komputer},
doi = {10.24843/LKJITI.2018.v09.i03.p06}
}

@inproceedings{S12_restore_ssd,
author={Ninahualpa, Geovanni and Perez, Carolina and Yoo, Sang Guun and Guarda, Teresa and Diaz, Javier and Piccirilli, Dario},
booktitle={2018 13th Iberian Conference on Information Systems and Technologies (CISTI)}, 
title={Restoring data in solid state devices damaged by crushing and falling, using file carving technique}, 
year={2018},
volume={},
number={},
pages={1-4},
doi={10.23919/CISTI.2018.8399344}
}

@article{S13_current_trim,
author={Shey, James and Blanco, Justin A. and Walker, Owens and Tedesso, Thomas W. and Ngo, Hau T. and Rakvic, Ryan and Fairbanks, Kevin D.},
journal={IEEE Transactions on Information Forensics and Security}, 
title={Monitoring Device Current to Characterize Trim Operations of Solid-State Drives}, 
year={2019},
volume={14},
number={5},
pages={1296-1306},
doi={10.1109/TIFS.2018.2876835}
}

@inproceedings{S14_trim_wl_gc,
author={Nisbet, Alastair and Jacob, Rijo},
booktitle={2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)}, 
title={TRIM, Wear Levelling and Garbage Collection on Solid State Drives: A Prediction Model for Forensic Investigators}, 
year={2019},
volume={},
number={},
pages={419-426},
doi={10.1109/TrustCom/BigDataSE.2019.00063}
}

@techreport{S15_trimming_ssd,
author = {Kandala, Shoban},
institution = {St. Cloud State University},
title = {{Analyzing the Trimming Activity of Solid-State Drives in Digital Forensics}},
type = {},
publisher = {}, 
url = {https://repository.stcloudstate.edu/msia_etds/81},
number = {81},
year = {2019}
}


@inproceedings{S16_comparitive,
author={Neyaz, Ashar and Zhou, Bing and Karpoor, Narasimha},
booktitle={2019 IEEE International Conference on Big Data (Big Data)}, 
title={Comparative Study of Wear-leveling in Solid-State Drive with NTFS File System}, 
year={2019},
volume={},
number={},
pages={4294-4298},
doi={10.1109/BigData47090.2019.9006067}}

@article{S17_ssd_survey_2020,
title={A Survey On Solid-State Drive Forensic Analysis Techniques.},
author={Kumar, Avinash and Neyaz, Ashar and Shashidhar, Narasimha},
journal={International Journal of Computer Science and Security (IJCSS)},
volume={14},
number={2},
pages={13-22},
year={2020},
publisher={Computer Science Journals}
}

%%%%%%%%%Lit_review_NVME%%%%%%%%%

@article{N1_nikkel,
title = {NVM express drives and digital forensics},
journal = {Digital Investigation},
volume = {16},
pages = {38-45},
year = {2016},
issn = {1742-2876},
doi = {https://doi.org/10.1016/j.diin.2016.01.001},
url = {https://www.sciencedirect.com/science/article/pii/S1742287616000025},
author = {Bruce Nikkel}
}

@article{N2_analysis_nvme_static,
author = {Riadi, Imam and Hadi, Abdul},
title = {{Analysis of Digital SSD NVMe Evidence on Proprietary Operating Systems Using the Static Forensics Method}},
year = {2019}
}

@article{N3_analysis_trim_nvme,
author = {Riadi, Imam and Sunardi, Sunardi and Hadi, Abdul},
doi = {10.30595/juita.v8i1.6584},
journal = {JUITA: Jurnal Informatika},
volume = {8},
number = {1},
issn = {2579-8901},	pages = {65--74},
doi = {10.30595/juita.v8i1.6584},
url = {http://jurnalnasional.ump.ac.id/index.php/JUITA/article/view/6584},
publisher = {Lembaga Publikasi Ilmiah dan Penerbitan Universitas Muhammadiyah Purwokerto},
title = {{Analysis of Digital Evidence Trim Enable NVME SSD Using Static Forensics Method}},
year = {2020}
}

%%%%%%%%%Lit_review_Prefetch%%%%%%%%%

@techreport{Pf1_bulk_prefetch,
title={{Bulk Extractor Windows Prefetch Decoder}},
author={Garcia, II and Luis, E},
year={2011},
department= {Department of Computer Science},
institution={Naval Postgraduate School Monterey, CA}
}

@inproceedings{Pf2_prefetch_trojan,
author = {Heriyanto, Andri},
year = {2014},
month = {12},
pages = {},
title = {{Forensic Examination and Analysis of the Prefetch Files on the Banking Trojan Malware Incidents}},
doi = {10.13140/2.1.2460.5767}
}


@article{Pf3_df_prefetch,
title={{Digital Forensic Analysis on Prefetch Files}},
author={Shashidhar, Narasimha Karpoor and Novak, Dylan},
journal={International Journal of Information Security Science},
volume={4},
number={2},
pages={39-49},
year={2015}
}

@article{Pf4_srum,
title = {{Forensic Implications of System Resource Usage Monitor (SRUM) Data in Windows 8}},
journal = {Digital Investigation},
volume = {12},
pages = {53-65},
year = {2015},
issn = {1742-2876},
doi = {https://doi.org/10.1016/j.diin.2015.01.002},
url = {https://www.sciencedirect.com/science/article/pii/S1742287615000031},
author = {Khatri, Yogesh},

@inproceedings{Pf5_powerforensics,
author      = {Barakat, Akram and Hadi, Ali},
booktitle   =  {2016 Cybersecurity and Cyberforensics Conference (CCC)}, 
title       =  {{Windows Forensic Investigations Using PowerForensics Tool}}, 
year        =  {2016},
volume      =  {},
number      =  {},
pages       =  {41-47},
doi         =  {10.1109/CCC.2016.18}
}

@article{Pf6_leverage,
author = {Singh, Bhupendra and Singh, Upasna},
year = {2016},
month = {12},
pages = {37-54},
title = {{Leveraging the Windows Amcache.hve File in Forensic Investigations}},
volume = {11},
journal = {Journal of Digital Forensics, Security and Law},
doi = {10.15394/jdfsl.2016.1429}
}

@article{Pf7_hpd,
author = {Abdulelah, Zaid},
year = {2017},
month = {08},
pages = {37-39},
title = {{Design and Implement a Hidden Processes Detector (HPD) based on Windows Prefetch Files}},
volume = {171},
journal = {International Journal of Computer Applications},
doi = {10.5120/ijca2017915038}
}

@article{Pf8_for_del_artifact,
author = {Saleh, Mohammed and Shamaileh, Mona},
year = {2017},
month = {01},
pages = {1},
title = {{Forensic Artifacts Associated with Intentionally Deleted User Accounts}},
volume = {9},
journal = {International Journal of Electronic Security and Digital Forensics},
doi = {10.1504/IJESDF.2017.10003678}
}


@article{Pf9_win10_change,
author = {Hintea, Diana and Bird, Robert and Green, Michael},
year = {2017},
month = {01},
pages = {326},
title = {{An Investigation into the Forensic Implications of the Windows 10 Operating System: Recoverable Artefacts and Significant Changes from Windows 8.1}},
volume = {9},
journal = {International Journal of Electronic Security and Digital Forensics},
doi = {10.1504/IJESDF.2017.10008013}
}


@article{Pf10_pgm_exe,
author = {Singh, Bhupendra},
year = {2018},
month = {01},
pages = {},
title = {{Program Execution Analysis in Windows: A Study of Data Sources, their Format and Comparison of Forensic Capability}},
volume = {74},
journal = {Computers and Security},
doi = {10.1016/j.cose.2018.01.006}
}

@techreport{Pf11_mani_pf,
author = {Vouvoutsis, Vasilis},
institution = {University of Piraeus},
title = {{Manipulating and Generating Windows 10 Prefetch files}},
type = {},
publisher = {}, 
url = {https://dione.lib.unipi.gr/xmlui/handle/unipi/12017},
number = {},
year = {2019}
}

@phdthesis{Pf12_mal_pf,
title={{Behavioral Malware Detection and Classification Using Windows Prefetch Files}},
author={Alsulami, Bander},
year={2019},
publisher={Drexel University}
}

%%%%%%%%%Lit_review_BootCKCL.etl%%%%%%%%%

@inproceedings{B1_boot_browser,
author={Ohana, Donny Jacob and Shashidhar, Narasimha},
booktitle={2013 IEEE Security and Privacy Workshops}, 
title={Do Private and Portable Web Browsers Leave Incriminating Evidence? A Forensic Analysis of Residual Artifacts from Private and Portable Web Browsing Sessions}, 
year={2013},
volume={},
number={},
pages={135-142},
doi={10.1109/SPW.2013.18}
}

%%%%%-----NOT USED IN LIT REVIEW OF CHAPTER 4 SHELLBAGS Sh4_anti_for, Sh5_shell_linux, Sh7_tor_brow-----%%%%%

@techreport{Sh4_anti_for,
author = {Panwar, Narendra},
institution = {Sardar Patel University of Police, Security and Criminal Justice, Jodhpur}, 
title = {{Anti Forensics Analysis of File Wiping Tools}},
type = {},
publisher = {}, 
url = {https://www.idrbt.ac.in/assets/publications/Reports/Summer%20Interns%202016/Narendra%20Panwar.pdf},
number = {},
year = {2016}
}

@article{Sh5_shell_linux,
author = {Lees, Christopher John},
journal = {Digital Investigation},
publisher = {Elsevier Ltd},
title = {{GVFS metadata: Shellbags for Linux}},
year = {2016}
}

@article{Sh7_tor_brow,
author = {Muir, Matt and Leimich, Petra and Buchanan, William},
year = {2019},
month = {03},
pages = {},
title = {A Forensic Audit of the Tor Browser Bundle},
volume = {29},
journal = {Digital Investigation},
doi = {10.1016/j.diin.2019.03.009}
}
%%%%%-----NOT USED IN LIT REVIEW OF CHAPTER 4 SHELLBAGS Sh4_anti_for, Sh5_shell_linux, Sh7_tor_brow-----%%%%%