%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\setlength{\parindent}{50pt}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\begin{singlespace}
\noindent Neyaz, Ashar, \textit{NVMe-Assist: A Novel Theoretical Framework for Digital Forensic \small{A Case Study on NVMe Storage Devices and Related Artifacts on Windows 10}}, Doctor of Philosophy, \Month, \number\year, Sam Houston State University, Huntsville, Texas. \medskip
\end{singlespace}

%\begin{justify}
%\begin{doublespace}
%\vspace{-5mm}
\noindent \par With ever-advancing changes in technology come implications for the digital forensics community. In this document, we use the term \textit{digital forensics} to denote the scientific investigatory procedure to digital crimes and attacks. Digital forensi-cs examiners often find it challenging when new devices are used for nefarious activities. The examiners gather evidence from these devices based on supporting literature. Multiple factors contribute to a lack of research on a particular device or technology. The most common factors are that the technology is new to the market, and there has not been much time to conduct research. It is also likely that the technology is not popular enough to garner research attention. If an examiner encounters such a device, they are often required to develop impromptu solutions to investigate such a case.
Sometimes, examiners have to review their examination processes on model devices that labs are necessi-tated to purchase to see if existing methods suffice. This ad-hoc approach adds time and additional expense before actual analysis can commence. In this research, we investigate the new storage technology \textbf{Non-Volatile Memory Express (NVMe)}. This technolo-gy uses \textbf{Peripheral Component Interconnect (PCIe)} mechanics for its working. Since this storage technology is relatively new, it lacks a substantial digital forensi-cs foundation to draw upon to conduct a forensics investigation. 

%\noindent \hspace{8.9 mm}
%\par 
Also, to the best of our knowledge, there is an insufficient body of work to conduct sound forensics research on such devices. To this end, our framework, NVMe-Assist puts forth a strong theoretical foundation that empowers digital forensics examiners in conducting analysis on NVMe devices, including wear-leveling, TRIM, Prefetch files, Shellbags, and BootCKCL.etl.

%Therefore, in this proposal, we put forth a novel theoretical framework that we call \textbf{\textit{NVMe-Assist}} to perform digital forensics investigation on NVMe storage devices. Using our framework, practitioners can make sound forensic decisions on which analytical processes to apply when they encounter storage devices implementing this technology. \medskip

\begin{comment}
Any statements of general fact should be written using the present tense.
Prior research should be mentioned and explained using the past tense.
If the subject of your sentence is your study or the article you are writing (e.g. “Our study demonstrates…,” or “Here, we show…”), then you should use the present tense.
If you are stating a conclusion or an interpretation, use the present tense.
If the subject of your sentence is an actual result or observation (e.g. “Mice in Group B developed…”), you would use the past tense.

https://blog.wordvice.com/which-tense-should-be-used-in-abstracts-past-or-present/
\end{comment}

%\hspace{5 mm} To this end, our framework, NVMe-Assist puts forth a strong theoretical foundation that empowers digital forensics examiners in conducting analysis on NVMe devices, including the following artifacts as it pertains to most investigation:
\begin{comment}
\begin{enumerate}[label=(\alph*)]
	\item \textbf{Wear-leveling}- The wear-leveling mechanism evenly writes data in the storage cells of NVMe devices. This process also internally relocates the data across cells to preserve cells' life cycle. Due to this relocation of data, the hash value changes, which hampers the validation and verification process of forensic analysis.
	\item \textbf{TRIM}- The TRIM functionality marks the data to be deleted to write new information in the cells. As a result of this, the chances of recovering old data diminishes, which leads to incomplete forensic investigation
	\item \textbf{Shellbags}- They are valuable sources of information that include user preferences while browsing folders for a specific user.
	\item \textbf{Bootckcl.etl}- The Bootckcl.etl is a circular kernel context logs \textbf{\textit{(CKCL)}} file that contains information on computer booting. 
	\item \textbf{Prefetch files}-  Prefetch files speed up program applications' execution. Prefetching is a Windows feature implemented to decrease the load time of frequently used application.
\end{enumerate}
\end{comment}
%\end{doublespace}

\noindent KEY WORDS: NVMe, PCIe, wear-leveling, TRIM, Shellbags, Prefetch files, \\ BootCKCL.etl.
%\end{justify}