Christopher Hargreaves : Publications
Click here to download all publications in a single bibtex file
@article{Stoyanov2026ContainerSnapshots,
title = "Forensic analysis of container snapshot chains for post-event reconstruction",
author = "Stoyanov, Radostin and Goldoni, Lorena and Reber, Adrian and Hargreaves, Christopher and Bruno, Rodrigo",
year = "2026",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "jun",
pages = "302114",
publisher = "Elsevier",
volume = "57",
doi = "10.1016/j.fsidi.2026.302114",
}
@article{Schneider2026AntiForensicsNext10,
title = "Digital Anti-Forensics Research: The Next 10 Years",
author = "Schneider, Janine and Ramming, Florian and Eichhorn, Maximilian and Pugliese, Gaston and Hargreaves, Christopher and Gruber Kastel, Jan and Schilling, Joschua and Geus, Julian and Mayer, Kevin and Uhlenbrock, Lea and Voigt, Lena Lucia and Breitinger, Frank",
year = "2026",
issn = "2576-5337",
journal = "Digital Threats: Research and Practice",
month = "oct",
note = "Online ahead of issue assignment",
publisher = "Association for Computing Machinery",
doi = "10.1145/3846198",
}
@misc{Schneider2026SoKAntiForensics,
title = "{SoK}: Understanding Anti-Forensics Concepts and Research Practices Across Forensic Subdomains",
author = "Schneider, Janine and Ramming, Florian and Eichhorn, Maximilian and Pugliese, Gaston and Hargreaves, Chris and Gruber, Jan and Schilling, Joschua and Geus, Julian and Mayer, Kevin and Uhlenbrock, Lea and Voigt, Lena and Breitinger, Frank",
year = "2026",
note = "Preprint, v2 (8 Apr 2026)",
doi = "10.48550/arXiv.2604.05770",
}
@article{Breitinger2025SoKTimeline,
title = "{SoK}: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges",
author = "Breitinger, Frank and Studiawan, Hudan and Hargreaves, Chris",
year = "2025",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "jul",
pages = "301932",
publisher = "Elsevier",
volume = "53",
doi = "10.1016/j.fsidi.2025.301932",
}
@inproceedings{Vanini2025TimestampTampering,
title = "Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction",
author = "Vanini, C{\'e}line and Gruber, Jan and Hargreaves, Christopher and Benenson, Zinaida and Freiling, Felix and Breitinger, Frank",
year = "2025",
booktitle = "Proceedings of the Digital Forensics Doctoral Symposium (DFDS 2025)",
month = "apr",
pages = "1--8",
publisher = "ACM",
doi = "10.1145/3712716.3712727",
}
@article{Voigt2025DiskImageMetrics,
title = "A metrics-based look at disk images: Insights and applications",
author = "Voigt, Lena L. and Freiling, Felix and Hargreaves, Christopher",
year = "2025",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "mar",
pages = "301874",
publisher = "Elsevier",
volume = "52",
doi = "10.1016/j.fsidi.2025.301874",
}
@article{Hargreaves2025SOLVEIT,
title = "{SOLVE-IT}: A proposed digital forensic knowledge base inspired by {MITRE} {ATT\&CK}",
author = "Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan",
year = "2025",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "mar",
pages = "301864",
publisher = "Elsevier",
volume = "52",
doi = "10.1016/j.fsidi.2025.301864",
}
@article{Pohl2025DiskForge,
title = "{DiskForge}: Timestomping on Disk Images for Educational Benefit",
author = "Pohl, Niclas and Voigt, Lena L. and Hargreaves, Christopher and Fein, Christofer and Freiling, Felix",
year = "2025",
issn = "2576-5337",
journal = "Digital Threats: Research and Practice",
month = "dec",
number = "4",
pages = "1--20",
publisher = "Association for Computing Machinery",
volume = "6",
doi = "10.1145/3748265",
}
@article{Vanini2025TamperResistance,
title = "Evaluating Tamper Resistance of Digital Forensic Artifacts during Event Reconstruction",
author = "Vanini, C{\'e}line and Hargreaves, Chris and Breitinger, Frank",
year = "2025",
issn = "2576-5337",
journal = "Digital Threats: Research and Practice",
month = "dec",
number = "4",
pages = "1--16",
publisher = "Association for Computing Machinery",
volume = "6",
doi = "10.1145/3765627",
}
@article{ClaijSwart2025ReferenceData,
title = "Automatically generating digital forensic reference data triggered by mobile application updates",
author = "Claij-Swart, Angelina A. and Oudsen, Erik and Timbermont, Bouke and Hargreaves, Christopher and Voigt, Lena L.",
year = "2025",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "oct",
pages = "301985",
publisher = "Elsevier",
volume = "54",
doi = "10.1016/j.fsidi.2025.301985",
}
@inproceedings{Kanta2025KeywordLists,
title = "Measuring the Effectiveness of Keyword Lists in Digital Forensics",
author = "Kanta, Aikaterini and Hargreaves, Christopher",
year = "2025",
address = "Cham",
booktitle = "Availability, Reliability and Security: ARES 2025 International Workshops, Ghent, Belgium, August 11--14, 2025, Proceedings, Part III",
editor = "Coppens, Bart and Volckaert, Bruno and Naessens, Vincent and De Sutter, Bjorn",
isbn = "978-3-032-00635-6",
pages = "42--59",
publisher = "Springer",
series = "Lecture Notes in Computer Science",
volume = "15996",
doi = "10.1007/978-3-032-00635-6_3",
}
@inproceedings{Hargreaves2025Replika,
title = "Forensic Analysis of {AI} Applications -- A {Replika} ``{AI} Companion'' Example",
author = "Hargreaves, Christopher and Drury, Dan",
year = "2025",
address = "Cham",
booktitle = "Availability, Reliability and Security: ARES 2025 International Workshops, Ghent, Belgium, August 11--14, 2025, Proceedings, Part III",
editor = "Coppens, Bart and Volckaert, Bruno and Naessens, Vincent and De Sutter, Bjorn",
isbn = "978-3-032-00635-6",
pages = "78--95",
publisher = "Springer",
series = "Lecture Notes in Computer Science",
volume = "15996",
doi = "10.1007/978-3-032-00635-6_5",
}
@inproceedings{Webb2024ResponsibleAIPolicing,
title = "Responsible {AI} in policing",
author = "Webb, Helena and Fitzroy-Dale, Nicholas and Aqeel, Saamiya and Piskopani, Anna Maria and Stafford-Fraser, Quentin and Nikolaou, Christos and Dowthwaite, Liz and McAuley, Derek and Hargreaves, Christopher",
year = "2024",
booktitle = "Proceedings of the Second International Symposium on Trustworthy Autonomous Systems (TAS '24)",
month = "sep",
pages = "1--5",
publisher = "ACM",
doi = "10.1145/3686038.3686070",
}
@article{Vanini2024ClockCorrect,
title = "Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction",
author = "Vanini, C{\'e}line and Hargreaves, Christopher J. and van Beek, Harm and Breitinger, Frank",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "jul",
pages = "301759",
publisher = "Elsevier",
volume = "49",
doi = "10.1016/j.fsidi.2024.301759",
}
@article{Schneider2024DigitalStratigraphy,
title = "Applying digital stratigraphy to the problem of recycled storage media",
author = "Schneider, Janine and Eichhorn, Maximilian and Dreier, Lisa Marie and Hargreaves, Christopher",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "jul",
pages = "301761",
publisher = "Elsevier",
volume = "49",
doi = "10.1016/j.fsidi.2024.301761",
}
@article{Dreier2024BeyondTimestamps,
title = "Beyond timestamps: Integrating implicit timing information into digital forensic timelines",
author = "Dreier, Lisa Marie and Vanini, C{\'e}line and Hargreaves, Christopher J. and Breitinger, Frank and Freiling, Felix",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "jul",
pages = "301755",
publisher = "Elsevier",
volume = "49",
doi = "10.1016/j.fsidi.2024.301755",
}
@article{Hargreaves2024AbstractModel,
title = "An abstract model for digital forensic analysis tools -- A foundation for systematic error mitigation analysis",
author = "Hargreaves, Christopher and Nelson, Alex and Casey, Eoghan",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "mar",
pages = "301679",
publisher = "Elsevier",
volume = "48",
doi = "10.1016/j.fsidi.2023.301679",
}
@article{BREITINGER2024301685,
title = "{DFRWS EU} 10-year review and future directions in Digital Forensic Research",
author = "Breitinger, Frank and Hilgert, Jan-Niclas and Hargreaves, Christopher and Sheppard, John and Overdorf, Rebekah and Scanlon, Mark",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "mar",
pages = "301685",
publisher = "Elsevier",
volume = "48",
doi = "10.1016/j.fsidi.2023.301685",
}
@article{Hargreaves2024DFPulse,
title = "{DFPulse}: The 2024 digital forensic practitioner survey",
author = "Hargreaves, Christopher and Breitinger, Frank and Dowthwaite, Liz and Webb, Helena and Scanlon, Mark",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "dec",
pages = "301844",
publisher = "Elsevier",
volume = "51",
doi = "10.1016/j.fsidi.2024.301844",
}
@article{Voigt2024ReImagen,
title = "{Re-imagen}: Generating coherent background activity in synthetic scenario-based forensic datasets using large language models",
author = "Voigt, Lena L. and Freiling, Felix and Hargreaves, Christopher J.",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
month = "oct",
pages = "301805",
publisher = "Elsevier",
volume = "50",
doi = "10.1016/j.fsidi.2024.301805",
}
@article{HARGREAVES2024301679,
title = "An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis",
author = "Christopher Hargreaves and Alex Nelson and Eoghan Casey",
year = "2024",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
keywords = "Digital forensics tools, Digital forensics process, Abstraction layers, Validation, Error, Tool testing, CASE",
note = "DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe",
pages = "301679",
url = "https://www.sciencedirect.com/science/article/pii/S2666281723001981",
volume = "48",
doi = "https://doi.org/10.1016/j.fsidi.2023.301679",
}
@misc{Vanini2024TimestampTamperingExtended,
title = "Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction (extended version)",
author = "Vanini, C{\'e}line and Gruber, Jan and Hargreaves, Christopher and Benenson, Zinaida and Freiling, Felix and Breitinger, Frank",
year = "2024",
doi = "10.48550/arXiv.2501.00175",
}
@article{scanlon2023chatgpt,
title = "ChatGPT for digital forensic investigation: The good, the bad, and the unknown",
author = "Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John",
year = "2023",
journal = "Forensic Science International: Digital Investigation",
pages = "301609",
publisher = "Elsevier",
volume = "46",
}
@article{GRUBER2023301501,
title = "Contamination of digital evidence: Understanding an underexposed risk",
author = "Jan Gruber and Christopher J. Hargreaves and Felix C. Freiling",
year = "2023",
issn = "2666-2817",
journal = "Forensic Science International: Digital Investigation",
keywords = "Contamination, Digital evidence, Digital investigations",
note = "Selected papers of the Tenth Annual DFRWS EU Conference",
pages = "301501",
url = "https://www.sciencedirect.com/science/article/pii/S2666281723000021",
volume = "44",
doi = "https://doi.org/10.1016/j.fsidi.2023.301501",
}
@article{du2021tracegen,
title = "TraceGen: User activity emulation for digital forensic test image generation",
author = "Du, Xiaoyu and Hargreaves, Christopher and Sheppard, John and Scanlon, Mark",
year = "2021",
journal = "Forensic Science International: Digital Investigation",
pages = "301133",
publisher = "Elsevier",
volume = "38",
}
@inproceedings{du2020sok,
title = "SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation",
author = "Du, Xiaoyu and Hargreaves, Chris and Sheppard, John and Anda, Felix and Sayakkara, Asanka and Le-Khac, Nhien-An and Scanlon, Mark",
year = "2020",
booktitle = "Proceedings of the 15th International Conference on Availability, Reliability and Security",
pages = "1--10",
}
@article{hargreaves2019synctriage,
title = "SyncTriage: Using synchronisation artefacts to optimise acquisition order",
author = "Hargreaves, Christopher and Marshall, Angus",
year = "2019",
journal = "Digital Investigation",
pages = "S134--S140",
publisher = "Elsevier",
volume = "28",
}
@incollection{Hargreaves2017,
title = "{Digital Forensics Education}",
author = "Hargreaves, Christopher",
year = "2017",
booktitle = "Forensic Science Education and Training",
editor = "Williams and Cassella and Maskell",
publisher = "Wiley",
}
@inproceedings{Hargreaves2013,
title = "{Visualisation of allocated and unallocated data blocks in digital forensics}",
author = "Hargreaves, Christopher",
year = "2013",
booktitle = "Proceedings of the European Information Security Multi-Conference",
pages = "133--143",
}
@inproceedings{David2013,
title = "{Detecting Tor Vidalia Bundle Installation}",
author = "David, Anne and Hargreaves, Christopher",
year = "2013",
booktitle = "International Conference on Cybercrime, Security and Digital Forensics",
}
@article{Chivers2012,
title = "{Forensic data recovery from the Windows Search Database}",
author = "Chivers, Howard and Hargreaves, Christopher",
year = "2012",
journal = "Digital Investigation",
number = "SUPPL",
pages = "S69--S79",
volume = "9",
}
@article{Hargreaves2012,
title = "{An automated timeline reconstruction approach for digital forensic investigations}",
author = "Hargreaves, Christopher and Patterson, Jonathan",
year = "2012",
journal = "Digital Investigation",
number = "SUPPL",
pages = "69--79",
volume = "9",
}
@inproceedings{David2012,
title = "{An analysis of Hotmail artefacts in Firefox}",
author = "David, Anne and Hargreaves, Christopher",
year = "2012",
booktitle = "6th Cybercrime Forensics Education and Training",
}
@inproceedings{Patterson2012,
title = "{The Potential for cross-drive analysis using automated digital forensic timelines}",
author = "Patterson, Jonathan and Hargreaves, Christopher",
year = "2012",
booktitle = "6th Cybercrime Forensics Education and Training",
}
@inproceedings{Patterson2011,
title = "{ Automated identification and reconstruction of YouTube video access}",
author = "Patterson, Jonathan and Hargreaves, Christopher",
year = "2011",
booktitle = "5th Cybercrime Forensics Education and Training",
}
@article{Rabaiotti2010,
title = "{Using a software exploit to image RAM on an embedded system}",
author = "Rabaiotti, Joseph and Hargreaves, Christopher",
year = "2010",
journal = "Digital Investigation",
number = "3-4",
pages = "95--103",
volume = "6",
}
@inproceedings{Hargreaves2010a,
title = "{A Virtualisation based forensic computing research tool}",
author = "Hargreaves, Christopher and Chivers, Howard",
year = "2010",
booktitle = "4th Cybercrime Forensics Education and Training",
}
@inproceedings{Hargreaves2010,
title = "{Detecting hidden encrypted volumes}",
author = "Hargreaves, Christopher and Chivers, Howard",
year = "2010",
booktitle = "Communications and Multimedia Security : 11th IFIP TC 6/TC 11 International Conference, CMS 2010",
}
@inproceedings{Hargreaves2009,
title = "{Establishing context when investigating a suspect's internet usage}",
author = "Hargreaves, Christopher",
year = "2009",
booktitle = "3rd Cybercrime Forensics Education {\&} Training",
}
@article{Hargreaves2008b,
title = "{Windows Vista and digital investigations}",
author = "Hargreaves, Christopher and Chivers, Howard and David, Titheridge",
year = "2008",
journal = "Digital Investigation",
number = "1-2",
pages = "34--48",
volume = "5",
}
@inproceedings{Hargreaves2008a,
title = "{Recovery of Encryption Keys from Memory Using a Linear Scan}",
author = "Hargreaves, Christopher and Chivers, Howard",
year = "2008",
booktitle = "International Workshop on Digital Forensics (WSDF'08) as part of The Third International Conference on Availability, Reliability and Security (ARES 2008)",
}
@inproceedings{Hargreaves2008,
title = "{Avoiding live imaging of large encrypted volumes by recovering keys from memory.}",
author = "Hargreaves, Christopher and Chivers, Howard",
year = "2008",
address = "Liverpool",
booktitle = "Advanced in Digital Forensics and Security",
}
@inproceedings{Hargreaves2007,
title = "{Potential Impacts of Windows Vista on Digital Investigations}",
author = "Hargreaves, Christopher and Chivers, Howard",
year = "2007",
booktitle = "Advanced in Computer Security and Forensics",
}
@inproceedings{Hargreaves2006,
title = "{A PDA-Based Live Forensic Tool}",
author = "Hargreaves, Christopher and Chivers, Howard and Sutherland, Iain",
year = "2006",
booktitle = "Proceedings from 1st Advances in Computer Security and Forensics",
}