[1]Bates J. Fundamentals of computer forensics [J]. Information Security Technical Report, 1998, 3(4):7578.[2]Casey E. Handbook of digital forensics and investigation [M]. Burlington, Mass. USA: Academic Press, 2010.[3]ISO/IEC 27037, Guidelines for identification, collection, acquisition and preservation of digital evidence (DIS) [S].[4]Volonino L, Anzaldua R, Godwin J, et al. Computer forensics: Principles and practice [M]. Upper Saddle River, New Jersey, USA: Prentice Hall, 2006.[5]Jones A, Valli C. Building a digital forensic laboratory [M]. Burlington, Massachusetts, USA: Elsevier, Inc, 2009.[6]Halderman J, Schoen S, Heninger A, et al. Lest we remember Cold boot attacks on encryption keys [C]// van Oorschot P. Proceedings of the 17th USENIX Security Symposium. San Jose, California, USA: USENIX Association, 2008: 4560.[7]Garber L. EnCase: A case study in computerforensic technology [J]. IEEE Computer, 2001, 34(1): 202205.[8]Negus C. Live Linux CDs: Building and customizing bootable [M]. Upper Saddle River, New Jersey, USA: Prentice Hall, 2007.[9]Pogue C, Altheide C, Haverkos T. UNIX and Linux forensic analysis DVD toolkit [M]. Burlington, Mass. USA: Syngress Publishing, 2008.[10]Adelstein F. Live forensics: Diagnosing your system without killing it first [J]. Communications of the ACM, 2006, 49(2): 6366.[11]Dang Q. SP 800107: Recommendation for applications using approved hash algorithms [R]. Gaithersburg, Maryland, USA: National Institute of Standards and Technology, 2009.[12]Jansen W, Ayers R. SP 800101: Guidelines on cell phone forensics [R]. Gaithersburg, Maryland, USA: National Institute of Standards and Technology, 2007. |