@article{BREITINGER2024301685,
  title = "DFRWS EU 10-year review and future directions in Digital Forensic Research",
  author = "Frank Breitinger and Jan-Niclas Hilgert and Christopher Hargreaves and John Sheppard and Rebekah Overdorf and Mark Scanlon",
  year = "2024",
  issn = "2666-2817",
  journal = "Forensic Science International: Digital Investigation",
  keywords = "Digital forensics research, Digital forensic science, DFRWS, Research trends, Future directions",
  note = "DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe",
  pages = "301685",
  url = "https://www.sciencedirect.com/science/article/pii/S2666281723002044",
  volume = "48",
  doi = "https://doi.org/10.1016/j.fsidi.2023.301685",
}
@article{HARGREAVES2024301679,
  title = "An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis",
  author = "Christopher Hargreaves and Alex Nelson and Eoghan Casey",
  year = "2024",
  issn = "2666-2817",
  journal = "Forensic Science International: Digital Investigation",
  keywords = "Digital forensics tools, Digital forensics process, Abstraction layers, Validation, Error, Tool testing, CASE",
  note = "DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe",
  pages = "301679",
  url = "https://www.sciencedirect.com/science/article/pii/S2666281723001981",
  volume = "48",
  doi = "https://doi.org/10.1016/j.fsidi.2023.301679",
}
@article{scanlon2023chatgpt,
  title = "ChatGPT for digital forensic investigation: The good, the bad, and the unknown",
  author = "Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John",
  year = "2023",
  journal = "Forensic Science International: Digital Investigation",
  pages = "301609",
  publisher = "Elsevier",
  volume = "46",
}
@article{GRUBER2023301501,
  title = "Contamination of digital evidence: Understanding an underexposed risk",
  author = "Jan Gruber and Christopher J. Hargreaves and Felix C. Freiling",
  year = "2023",
  issn = "2666-2817",
  journal = "Forensic Science International: Digital Investigation",
  keywords = "Contamination, Digital evidence, Digital investigations",
  note = "Selected papers of the Tenth Annual DFRWS EU Conference",
  pages = "301501",
  url = "https://www.sciencedirect.com/science/article/pii/S2666281723000021",
  volume = "44",
  doi = "https://doi.org/10.1016/j.fsidi.2023.301501",
}
@article{du2021tracegen,
  title = "TraceGen: User activity emulation for digital forensic test image generation",
  author = "Du, Xiaoyu and Hargreaves, Christopher and Sheppard, John and Scanlon, Mark",
  year = "2021",
  journal = "Forensic Science International: Digital Investigation",
  pages = "301133",
  publisher = "Elsevier",
  volume = "38",
}
@inproceedings{du2020sok,
  title = "SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation",
  author = "Du, Xiaoyu and Hargreaves, Chris and Sheppard, John and Anda, Felix and Sayakkara, Asanka and Le-Khac, Nhien-An and Scanlon, Mark",
  year = "2020",
  booktitle = "Proceedings of the 15th International Conference on Availability, Reliability and Security",
  pages = "1--10",
}
@article{hargreaves2019synctriage,
  title = "SyncTriage: Using synchronisation artefacts to optimise acquisition order",
  author = "Hargreaves, Christopher and Marshall, Angus",
  year = "2019",
  journal = "Digital Investigation",
  pages = "S134--S140",
  publisher = "Elsevier",
  volume = "28",
}
@incollection{Hargreaves2017,
  title = "{Digital Forensics Education}",
  author = "Hargreaves, Christopher",
  year = "2017",
  booktitle = "Forensic Science Education and Training",
  editor = "Williams and Cassella and Maskell",
  publisher = "Wiley",
}
@inproceedings{Hargreaves2013,
  title = "{Visualisation of allocated and unallocated data blocks in digital forensics}",
  author = "Hargreaves, Christopher",
  year = "2013",
  booktitle = "Proceedings of the European Information Security Multi-Conference",
  pages = "133--143",
}
@inproceedings{David2013,
  title = "{Detecting Tor Vidalia Bundle Installation}",
  author = "David, Anne and Hargreaves, Christopher",
  year = "2013",
  booktitle = "International Conference on Cybercrime, Security and Digital Forensics",
}
@inproceedings{David2012,
  title = "{An analysis of Hotmail artefacts in Firefox}",
  author = "David, Anne and Hargreaves, Christopher",
  year = "2012",
  booktitle = "6th Cybercrime Forensics Education and Training",
}
@article{Chivers2012,
  title = "{Forensic data recovery from the Windows Search Database}",
  author = "Chivers, Howard and Hargreaves, Christopher",
  year = "2012",
  journal = "Digital Investigation",
  number = "SUPPL",
  pages = "S69--S79",
  volume = "9",
}
@inproceedings{Patterson2012,
  title = "{The Potential for cross-drive analysis using automated digital forensic timelines}",
  author = "Patterson, Jonathan and Hargreaves, Christopher",
  year = "2012",
  booktitle = "6th Cybercrime Forensics Education and Training",
}
@article{Hargreaves2012,
  title = "{An automated timeline reconstruction approach for digital forensic investigations}",
  author = "Hargreaves, Christopher and Patterson, Jonathan",
  year = "2012",
  journal = "Digital Investigation",
  number = "SUPPL",
  pages = "69--79",
  volume = "9",
}
@inproceedings{Patterson2011,
  title = "{ Automated identification and reconstruction of YouTube video access}",
  author = "Patterson, Jonathan and Hargreaves, Christopher",
  year = "2011",
  booktitle = "5th Cybercrime Forensics Education and Training",
}
@article{Rabaiotti2010,
  title = "{Using a software exploit to image RAM on an embedded system}",
  author = "Rabaiotti, Joseph and Hargreaves, Christopher",
  year = "2010",
  journal = "Digital Investigation",
  number = "3-4",
  pages = "95--103",
  volume = "6",
}
@inproceedings{Hargreaves2010a,
  title = "{A Virtualisation based forensic computing research tool}",
  author = "Hargreaves, Christopher and Chivers, Howard",
  year = "2010",
  booktitle = "4th Cybercrime Forensics Education and Training",
}
@inproceedings{Hargreaves2010,
  title = "{Detecting hidden encrypted volumes}",
  author = "Hargreaves, Christopher and Chivers, Howard",
  year = "2010",
  booktitle = "Communications and Multimedia Security : 11th IFIP TC 6/TC 11 International Conference, CMS 2010",
}
@inproceedings{Hargreaves2009,
  title = "{Establishing context when investigating a suspect's internet usage}",
  author = "Hargreaves, Christopher",
  year = "2009",
  booktitle = "3rd Cybercrime Forensics Education {\&} Training",
}
@article{Hargreaves2008b,
  title = "{Windows Vista and digital investigations}",
  author = "Hargreaves, Christopher and Chivers, Howard and David, Titheridge",
  year = "2008",
  journal = "Digital Investigation",
  number = "1-2",
  pages = "34--48",
  volume = "5",
}
@inproceedings{Hargreaves2008a,
  title = "{Recovery of Encryption Keys from Memory Using a Linear Scan}",
  author = "Hargreaves, Christopher and Chivers, Howard",
  year = "2008",
  booktitle = "International Workshop on Digital Forensics (WSDF'08) as part of The Third International Conference on Availability, Reliability and Security (ARES 2008)",
}
@inproceedings{Hargreaves2008,
  title = "{Avoiding live imaging of large encrypted volumes by recovering keys from memory.}",
  author = "Hargreaves, Christopher and Chivers, Howard",
  year = "2008",
  address = "Liverpool",
  booktitle = "Advanced in Digital Forensics and Security",
}
@inproceedings{Hargreaves2007,
  title = "{Potential Impacts of Windows Vista on Digital Investigations}",
  author = "Hargreaves, Christopher and Chivers, Howard",
  year = "2007",
  booktitle = "Advanced in Computer Security and Forensics",
}
@inproceedings{Hargreaves2006,
  title = "{A PDA-Based Live Forensic Tool}",
  author = "Hargreaves, Christopher and Chivers, Howard and Sutherland, Iain",
  year = "2006",
  booktitle = "Proceedings from 1st Advances in Computer Security and Forensics",
}