[an error occurred while processing this directive]<meta name="keywords" content="Department of Computer Science, publications, by type, Christopher Hargreaves"></meta><meta name="description" content="Publications, by type, Department of Computer Science, Oxford, Christopher Hargreaves"></meta><title>Department of Computer Science, University of Oxford: Christopher Hargreaves : Publications
</title><style type="text/css">
			  .btn-toolbar::after, .btn-toolbar::before
			  {
			    content: " ";
			    display: table;
			  }

			
			.btn-toolbar
			{
			    margin-bottom: 2em;
			}

			  .btn-toolbar::after, .btn-group::after
			  {
			    clear: both;
			  }


			.btn-toolbar .btn, .btn-toolbar .btn-group
			  {
			    float: left;
			}
			
			.btn-group
			  {
			    display: inline-block;
			    position: relative;
			    vertical-align: middle;
			}

			  .btn-group > .btn:first-child:not(:last-child)
			  {
			    border-bottom-right-radius: 0;
			    border-top-right-radius: 0;
			}
			
			.btn-group > .btn:first-child
			  {
			    margin-left: 0;
			}

			.btn-group > .btn
			  {
			    float: left;
			    position: relative;
			}

			  .btn-group > .btn:not(:first-child):not(:last-child)
			  {
			    border-radius: 0;
			}
			
			  .btn-group > .btn:last-child:not(:first-child)
			  {
			    border-bottom-left-radius: 0;
			    border-top-left-radius: 0;
			}
			
			.btn-group .btn + .btn, .btn-group .btn + .btn-group, .btn-group .btn-group + .btn, .btn-group .btn-group + .btn-group
			  {
			    margin-left: -2px;
			}
			</style>[an error occurred while processing this directive]<div class="content-width"><ol class="breadcrumb text-uppercase"><li><a href="/">Home</a></li><li><a href="/aboutus/">About Us</a></li><li><a href="/people/">People</a></li><li><a href="/people/faculty.html">Faculty</a></li><li><a href="/people/Christopher.Hargreaves"><span itemprop="name">Christopher Hargreaves</span></a></li><li class="active">Publications</li></ol></div><!-- MOBILE NAVIGATION --><div class="content-width space-below mobile-menu-placeholder visible-xs visible-sm"></div><!-- COLUMNS --><div class="container-fluid content-width"><div class="row"><div class="col-xs-12 col-md-9 col-md-push-3" id="maincontent"><!-- CONTENT (Column 2) --><div class="page-title"><h1>Christopher Hargreaves : Publications
</h1></div><div role="toolbar" class="btn-toolbar"><div class="btn-group"><a href="/people/publications/date/Christopher.Hargreaves.html" aria-hidden="true" type="button" class="btn btn-default"><span class="glyphicon glyphicon-sort-by-attributes"></span> By date</a><a href="/people/publications/title/Christopher.Hargreaves.html" aria-hidden="true" type="button" class="btn btn-default"><span class="glyphicon glyphicon-sort-by-attributes"></span> By title</a><a href="/people/publications/type/Christopher.Hargreaves.html" aria-hidden="true" type="button" class="btn btn-oxford-blue"><span class="glyphicon glyphicon-sort-by-attributes"></span> By type</a><a href="/people/publications/bibtex/Christopher.Hargreaves.html" aria-hidden="true" type="button" class="btn btn-default"><span class="glyphicon glyphicon-file"></span> BibTex</a></div></div><p></p><h2>
      Book chapters
      </h2><ul class="list-unbulleted list-unbulleted-spaced"><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[1] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Digital Forensics Education </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In Williams&#x201a; Cassella and Maskell, editors,
             
            <em>
            Forensic Science Education and Training</em>.
        Wiley.
        2017.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12422-abstract.html">
			Details <span class="sr-only" > about <em> Digital Forensics Education  </em></span> </a> |
			<a href="/publications/publication12422.bib">
			BibTeX  <span class="sr-only" > data for <em> Digital Forensics Education  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li></ul><h2>
      Journal papers
      </h2><ul class="list-unbulleted list-unbulleted-spaced"><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[1] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            DFRWS EU 10&#x2212;year review and future directions in Digital Forensic Research </strong> </p>
	    <p class="publicationAuthors"> <em> Frank Breitinger&#x201a; Jan&#x2212;Niclas Hilgert&#x201a; Christopher Hargreaves&#x201a; John Sheppard&#x201a; Rebekah Overdorf and Mark Scanlon  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Forensic Science International: Digital Investigation</em>.
        
            Vol. 48.
        
                Pages 301685.
            2024.
        </p> <p
            class="publicationNote"> DFRWS EU 2024 &#x2212; Selected Papers from the 11th Annual Digital Forensics Research Conference Europe</p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication16229-abstract.html">
			Details <span class="sr-only" > about <em> DFRWS EU 10&#x2212;year review and future directions in Digital Forensic Research  </em></span> </a> |
			<a href="/publications/publication16229.bib">
			BibTeX  <span class="sr-only" > data for <em> DFRWS EU 10&#x2212;year review and future directions in Digital Forensic Research  </em></span>   </a>
			
			 | <a
		href="http://dx.doi.org/https://doi.org/10.1016/j.fsidi.2023.301685">
		DOI (https://doi.org/10.1016/j.fsidi.2023.301685)
		</a> 
					| <a href="https://www.sciencedirect.com/science/article/pii/S2666281723002044"> Link <span class="sr-only" > to <em> DFRWS EU 10&#x2212;year review and future directions in Digital Forensic Research  </em></span> </a>
  				
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[2] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            An abstract model for digital forensic analysis tools &#x2212; A foundation for systematic error mitigation analysis </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves&#x201a; Alex Nelson and Eoghan Casey  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Forensic Science International: Digital Investigation</em>.
        
            Vol. 48.
        
                Pages 301679.
            2024.
        </p> <p
            class="publicationNote"> DFRWS EU 2024 &#x2212; Selected Papers from the 11th Annual Digital Forensics Research Conference Europe</p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication16228-abstract.html">
			Details <span class="sr-only" > about <em> An abstract model for digital forensic analysis tools &#x2212; A foundation for systematic error mitigation analysis  </em></span> </a> |
			<a href="/publications/publication16228.bib">
			BibTeX  <span class="sr-only" > data for <em> An abstract model for digital forensic analysis tools &#x2212; A foundation for systematic error mitigation analysis  </em></span>   </a>
			
			 | <a
		href="http://dx.doi.org/https://doi.org/10.1016/j.fsidi.2023.301679">
		DOI (https://doi.org/10.1016/j.fsidi.2023.301679)
		</a> 
					| <a href="https://www.sciencedirect.com/science/article/pii/S2666281723001981"> Link <span class="sr-only" > to <em> An abstract model for digital forensic analysis tools &#x2212; A foundation for systematic error mitigation analysis  </em></span> </a>
  				
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[3] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            ChatGPT for digital forensic investigation: The good&#x201a; the bad&#x201a; and the unknown </strong> </p>
	    <p class="publicationAuthors"> <em> Mark Scanlon&#x201a; Frank Breitinger&#x201a; Christopher Hargreaves&#x201a; Jan&#x2212;Niclas Hilgert and John Sheppard  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Forensic Science International: Digital Investigation</em>.
        
            Vol. 46.
        
                Pages 301609.
            2023.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication16000-abstract.html">
			Details <span class="sr-only" > about <em> ChatGPT for digital forensic investigation: The good&#x201a; the bad&#x201a; and the unknown  </em></span> </a> |
			<a href="/publications/publication16000.bib">
			BibTeX  <span class="sr-only" > data for <em> ChatGPT for digital forensic investigation: The good&#x201a; the bad&#x201a; and the unknown  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[4] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Contamination of digital evidence: Understanding an underexposed risk </strong> </p>
	    <p class="publicationAuthors"> <em> Jan Gruber&#x201a; Christopher J. Hargreaves and Felix C. Freiling  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Forensic Science International: Digital Investigation</em>.
        
            Vol. 44.
        
                Pages 301501.
            2023.
        </p> <p
            class="publicationNote"> Selected papers of the Tenth Annual DFRWS EU Conference</p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication15886-abstract.html">
			Details <span class="sr-only" > about <em> Contamination of digital evidence: Understanding an underexposed risk  </em></span> </a> |
			<a href="/publications/publication15886.bib">
			BibTeX  <span class="sr-only" > data for <em> Contamination of digital evidence: Understanding an underexposed risk  </em></span>   </a>
			
			 | <a
		href="http://dx.doi.org/https://doi.org/10.1016/j.fsidi.2023.301501">
		DOI (https://doi.org/10.1016/j.fsidi.2023.301501)
		</a> 
					| <a href="https://www.sciencedirect.com/science/article/pii/S2666281723000021"> Link <span class="sr-only" > to <em> Contamination of digital evidence: Understanding an underexposed risk  </em></span> </a>
  				
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[5] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            TraceGen: User activity emulation for digital forensic test image generation </strong> </p>
	    <p class="publicationAuthors"> <em> Xiaoyu Du&#x201a; Christopher Hargreaves&#x201a; John Sheppard and Mark Scanlon  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Forensic Science International: Digital Investigation</em>.
        
            Vol. 38.
        
                Pages 301133.
            2021.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication15738-abstract.html">
			Details <span class="sr-only" > about <em> TraceGen: User activity emulation for digital forensic test image generation  </em></span> </a> |
			<a href="/publications/publication15738.bib">
			BibTeX  <span class="sr-only" > data for <em> TraceGen: User activity emulation for digital forensic test image generation  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[6] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            SyncTriage: Using synchronisation artefacts to optimise acquisition order </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Angus Marshall  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Digital Investigation</em>.
        
            Vol. 28.
        
                Pages S134&#x2013;S140.
            2019.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication15736-abstract.html">
			Details <span class="sr-only" > about <em> SyncTriage: Using synchronisation artefacts to optimise acquisition order  </em></span> </a> |
			<a href="/publications/publication15736.bib">
			BibTeX  <span class="sr-only" > data for <em> SyncTriage: Using synchronisation artefacts to optimise acquisition order  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[7] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Forensic data recovery from the Windows Search Database </strong> </p>
	    <p class="publicationAuthors"> <em> Howard Chivers and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Digital Investigation</em>.
        
            Vol. 9.
        
            No. SUPPL.
        
                Pages S69&#x2013;S79.
            2012.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12427-abstract.html">
			Details <span class="sr-only" > about <em> Forensic data recovery from the Windows Search Database  </em></span> </a> |
			<a href="/publications/publication12427.bib">
			BibTeX  <span class="sr-only" > data for <em> Forensic data recovery from the Windows Search Database  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[8] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            An automated timeline reconstruction approach for digital forensic investigations </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Jonathan Patterson  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Digital Investigation</em>.
        
            Vol. 9.
        
            No. SUPPL.
        
                Pages 69&#x2013;79.
            2012.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12425-abstract.html">
			Details <span class="sr-only" > about <em> An automated timeline reconstruction approach for digital forensic investigations  </em></span> </a> |
			<a href="/publications/publication12425.bib">
			BibTeX  <span class="sr-only" > data for <em> An automated timeline reconstruction approach for digital forensic investigations  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[9] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Using a software exploit to image RAM on an embedded system </strong> </p>
	    <p class="publicationAuthors"> <em> Joseph Rabaiotti and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Digital Investigation</em>.
        
            Vol. 6.
        
            No. 3&#x2212;4.
        
                Pages 95&#x2013;103.
            2010.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12432-abstract.html">
			Details <span class="sr-only" > about <em> Using a software exploit to image RAM on an embedded system  </em></span> </a> |
			<a href="/publications/publication12432.bib">
			BibTeX  <span class="sr-only" > data for <em> Using a software exploit to image RAM on an embedded system  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[10] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Windows Vista and digital investigations </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves&#x201a; Howard Chivers and Titheridge David  </em> </p>
	
	<p class="publicationDetails"> 
        In <em>Digital Investigation</em>.
        
            Vol. 5.
        
            No. 1&#x2212;2.
        
                Pages 34&#x2013;48.
            2008.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12436-abstract.html">
			Details <span class="sr-only" > about <em> Windows Vista and digital investigations  </em></span> </a> |
			<a href="/publications/publication12436.bib">
			BibTeX  <span class="sr-only" > data for <em> Windows Vista and digital investigations  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li></ul><h2>
      Conference papers
      </h2><ul class="list-unbulleted list-unbulleted-spaced"><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[1] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation </strong> </p>
	    <p class="publicationAuthors"> <em> Xiaoyu Du&#x201a; Chris Hargreaves&#x201a; John Sheppard&#x201a; Felix Anda&#x201a; Asanka Sayakkara&#x201a; Nhien&#x2212;An Le&#x2212;Khac and Mark Scanlon  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Proceedings of the 15th International Conference on Availability&#x201a; Reliability and Security</em>.
        
                Pages 1&#x2013;10.
            2020.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication15737-abstract.html">
			Details <span class="sr-only" > about <em> SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation  </em></span> </a> |
			<a href="/publications/publication15737.bib">
			BibTeX  <span class="sr-only" > data for <em> SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[2] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Visualisation of allocated and unallocated data blocks in digital forensics </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Proceedings of the European Information Security Multi&#x2212;Conference</em>.
        
                Pages 133&#x2013;143.
            2013.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12424-abstract.html">
			Details <span class="sr-only" > about <em> Visualisation of allocated and unallocated data blocks in digital forensics  </em></span> </a> |
			<a href="/publications/publication12424.bib">
			BibTeX  <span class="sr-only" > data for <em> Visualisation of allocated and unallocated data blocks in digital forensics  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[3] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Detecting Tor Vidalia Bundle Installation </strong> </p>
	    <p class="publicationAuthors"> <em> Anne David and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            International Conference on Cybercrime&#x201a; Security and Digital Forensics</em>.
        2013.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12423-abstract.html">
			Details <span class="sr-only" > about <em> Detecting Tor Vidalia Bundle Installation  </em></span> </a> |
			<a href="/publications/publication12423.bib">
			BibTeX  <span class="sr-only" > data for <em> Detecting Tor Vidalia Bundle Installation  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[4] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            An analysis of Hotmail artefacts in Firefox </strong> </p>
	    <p class="publicationAuthors"> <em> Anne David and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            6th Cybercrime Forensics Education and Training</em>.
        2012.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12428-abstract.html">
			Details <span class="sr-only" > about <em> An analysis of Hotmail artefacts in Firefox  </em></span> </a> |
			<a href="/publications/publication12428.bib">
			BibTeX  <span class="sr-only" > data for <em> An analysis of Hotmail artefacts in Firefox  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[5] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            The Potential for cross&#x2212;drive analysis using automated digital forensic timelines </strong> </p>
	    <p class="publicationAuthors"> <em> Jonathan Patterson and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            6th Cybercrime Forensics Education and Training</em>.
        2012.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12426-abstract.html">
			Details <span class="sr-only" > about <em> The Potential for cross&#x2212;drive analysis using automated digital forensic timelines  </em></span> </a> |
			<a href="/publications/publication12426.bib">
			BibTeX  <span class="sr-only" > data for <em> The Potential for cross&#x2212;drive analysis using automated digital forensic timelines  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[6] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
             Automated identification and reconstruction of YouTube video access </strong> </p>
	    <p class="publicationAuthors"> <em> Jonathan Patterson and Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            5th Cybercrime Forensics Education and Training</em>.
        2011.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12429-abstract.html">
			Details <span class="sr-only" > about <em>  Automated identification and reconstruction of YouTube video access  </em></span> </a> |
			<a href="/publications/publication12429.bib">
			BibTeX  <span class="sr-only" > data for <em>  Automated identification and reconstruction of YouTube video access  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[7] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            A Virtualisation based forensic computing research tool </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Howard Chivers  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            4th Cybercrime Forensics Education and Training</em>.
        2010.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12431-abstract.html">
			Details <span class="sr-only" > about <em> A Virtualisation based forensic computing research tool  </em></span> </a> |
			<a href="/publications/publication12431.bib">
			BibTeX  <span class="sr-only" > data for <em> A Virtualisation based forensic computing research tool  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[8] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Detecting hidden encrypted volumes </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Howard Chivers  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Communications and Multimedia Security : 11th IFIP TC 6/TC 11 International Conference&#x201a; CMS 2010</em>.
        2010.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12430-abstract.html">
			Details <span class="sr-only" > about <em> Detecting hidden encrypted volumes  </em></span> </a> |
			<a href="/publications/publication12430.bib">
			BibTeX  <span class="sr-only" > data for <em> Detecting hidden encrypted volumes  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[9] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Establishing context when investigating a suspect's internet usage </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            3rd Cybercrime Forensics Education & Training</em>.
        2009.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12433-abstract.html">
			Details <span class="sr-only" > about <em> Establishing context when investigating a suspect's internet usage  </em></span> </a> |
			<a href="/publications/publication12433.bib">
			BibTeX  <span class="sr-only" > data for <em> Establishing context when investigating a suspect's internet usage  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[10] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Recovery of Encryption Keys from Memory Using a Linear Scan </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Howard Chivers  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            International Workshop on Digital Forensics (WSDF'08) as part of The Third International Conference on Availability&#x201a; Reliability and Security (ARES 2008)</em>.
        2008.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12435-abstract.html">
			Details <span class="sr-only" > about <em> Recovery of Encryption Keys from Memory Using a Linear Scan  </em></span> </a> |
			<a href="/publications/publication12435.bib">
			BibTeX  <span class="sr-only" > data for <em> Recovery of Encryption Keys from Memory Using a Linear Scan  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[11] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Avoiding live imaging of large encrypted volumes by recovering keys from memory. </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Howard Chivers  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Advanced in Digital Forensics and Security</em>.
        Liverpool.
        2008.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12434-abstract.html">
			Details <span class="sr-only" > about <em> Avoiding live imaging of large encrypted volumes by recovering keys from memory.  </em></span> </a> |
			<a href="/publications/publication12434.bib">
			BibTeX  <span class="sr-only" > data for <em> Avoiding live imaging of large encrypted volumes by recovering keys from memory.  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[12] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            Potential Impacts of Windows Vista on Digital Investigations </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves and Howard Chivers  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Advanced in Computer Security and Forensics</em>.
        2007.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12437-abstract.html">
			Details <span class="sr-only" > about <em> Potential Impacts of Windows Vista on Digital Investigations  </em></span> </a> |
			<a href="/publications/publication12437.bib">
			BibTeX  <span class="sr-only" > data for <em> Potential Impacts of Windows Vista on Digital Investigations  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li><li>
	
	<div class="row">
		
			<div class="col-xs-1 text-right">
				[13] 
			</div>

		
        
		<div
			class="col-xs-11"
		>
			
	
	<p class="publicationTitle"> <strong>
            A PDA&#x2212;Based Live Forensic Tool </strong> </p>
	    <p class="publicationAuthors"> <em> Christopher Hargreaves&#x201a; Howard Chivers and Iain Sutherland  </em> </p>
	
	<p class="publicationDetails"> 
            In  
            <em>
            Proceedings from 1st Advances in Computer Security and Forensics</em>.
        2006.
        </p>
	
        		<p class="publicationlinks"> <a
        
            		href="/publications/publication12438-abstract.html">
			Details <span class="sr-only" > about <em> A PDA&#x2212;Based Live Forensic Tool  </em></span> </a> |
			<a href="/publications/publication12438.bib">
			BibTeX  <span class="sr-only" > data for <em> A PDA&#x2212;Based Live Forensic Tool  </em></span>   </a>
			
			
		
		</div> 
	</div> 
	
        </li></ul></div><div class="col-xs-12 col-md-3 col-md-pull-9 side-menu-col"><h2 class="side-menu-title text-uppercase"><a href="#">About Us</a></h2><ul class="side-menu"><li class="active mobile-menu-source"><a href="/people/">People</a><ul><li class="active"><a href="/people/faculty.html">Faculty</a></li><li><a href="/people/research.html">Research</a></li><li><a href="/people/students.html">Students</a></li><li><a href="/people/support.html">Professional Services</a></li><li><a href="/people/visitingprofessors.html">Visiting Professors</a></li><li><a href="/people/emeritusfaculty.html">Emeritus Faculty</a></li></ul></li><li><a href="/aboutus/vacancies/">Vacancies</a></li><li><a href="/aboutus/women-cs-oxford/index.html">Women in the department</a></li><li><a href="/aboutus/equality-diversity-inclusion/index.html">Equality, diversity and inclusion</a></li><li><a href="https://www.alumniweb.ox.ac.uk/cs/make-a-donation">Support Us</a></li><li><a href="/aboutus/cshistory.html">Our History</a></li><li><a href="/aboutus/contact.html">Contact Us</a></li></ul></div></div></div>[an error occurred while processing this directive]