{"id":"https://openalex.org/W3008985704","doi":"https://doi.org/10.15394/jdfsl.2019.1591","title":"Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems","display_name":"Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W3008985704","doi":"https://doi.org/10.15394/jdfsl.2019.1591","mag":"3008985704"},"language":"en","primary_location":{"id":"doi:10.15394/jdfsl.2019.1591","doi":"https://doi.org/10.15394/jdfsl.2019.1591","is_oa":true,"landing_page_url":"https://doi.org/10.15394/jdfsl.2019.1591","pdf_url":"https://commons.erau.edu/cgi/viewcontent.cgi?article=1591&context=jdfsl","source":{"id":"https://openalex.org/S2764592663","display_name":"The journal of digital forensics, security and law","issn_l":"1558-7215","issn":["1558-7215","1558-7223"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4"],"host_organization":"https://openalex.org/P4310316352","host_organization_name":"Association of Digital Forensics, Security and Law","host_organization_lineage":["https://openalex.org/P4310316352"],"host_organization_lineage_names":["Association of Digital Forensics, Security and Law"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Digital Forensics, Security and Law","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://commons.erau.edu/cgi/viewcontent.cgi?article=1591&context=jdfsl","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017996847","display_name":"Sean McKeown","orcid":"https://orcid.org/0000-0001-7231-1682","observed_orcids":["https://orcid.org/0000-0001-7231-1682"]},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Sean McKeown","raw_affiliation_strings":["Napier University","School of Computing Edinburgh Napier University, Scotland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Napier University","institution_ids":["https://openalex.org/I251738"]},{"raw_affiliation_string":"School of Computing Edinburgh Napier University, Scotland","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050277773","display_name":"Gordon Russell","orcid":"https://orcid.org/0000-0002-3589-3051","observed_orcids":["https://orcid.org/0000-0002-3589-3051"]},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Gordon Russell","raw_affiliation_strings":["School of Computing Edinburgh Napier University, Scotland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing Edinburgh Napier University, Scotland","institution_ids":["https://openalex.org/I251738"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5049998815","display_name":"Petra Leimich","orcid":"https://orcid.org/0000-0001-9947-6831","observed_orcids":["https://orcid.org/0000-0001-9947-6831"]},"institutions":[{"id":"https://openalex.org/I251738","display_name":"Edinburgh Napier University","ror":"https://ror.org/03zjvnn91","country_code":"GB","type":"education","lineage":["https://openalex.org/I251738"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Petra Leimich","raw_affiliation_strings":["Napier University","School of Computing Edinburgh Napier University, Scotland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Napier University","institution_ids":["https://openalex.org/I251738"]},{"raw_affiliation_string":"School of Computing Edinburgh Napier University, Scotland","institution_ids":["https://openalex.org/I251738"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5049998815"],"corresponding_institution_ids":["https://openalex.org/I251738"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":{"value":0.25489803,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/forensic-triage","display_name":"forensic triage","score":0.9430000185966492},{"id":"https://openalex.org/keywords/microsoft-windows","display_name":"Microsoft Windows","score":0.9020000100135803},{"id":"https://openalex.org/keywords/perceptual-hashing","display_name":"perceptual hashing","score":0.921999990940094},{"id":"https://openalex.org/keywords/image-forensics","display_name":"image forensics","score":0.625}],"concepts":[{"id":"https://openalex.org/C160174412","wikidata":"https://www.wikidata.org/wiki/Q873806","display_name":"Thumbnail","level":3,"score":0.8994507789611816},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8341571688652039},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.7176148295402527},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.6601901054382324},{"id":"https://openalex.org/C7608002","wikidata":"https://www.wikidata.org/wiki/Q477202","display_name":"Cryptographic hash function","level":3,"score":0.5220686793327332},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.44469499588012695},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.44213494658470154},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.31624943017959595},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.17534971237182617},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.14497226476669312},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C194828623","wikidata":"https://www.wikidata.org/wiki/Q2861470","display_name":"Emergency medicine","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.15394/jdfsl.2019.1591","doi":"https://doi.org/10.15394/jdfsl.2019.1591","is_oa":true,"landing_page_url":"https://doi.org/10.15394/jdfsl.2019.1591","pdf_url":"https://commons.erau.edu/cgi/viewcontent.cgi?article=1591&context=jdfsl","source":{"id":"https://openalex.org/S2764592663","display_name":"The journal of digital forensics, security and law","issn_l":"1558-7215","issn":["1558-7215","1558-7223"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4"],"host_organization":"https://openalex.org/P4310316352","host_organization_name":"Association of Digital Forensics, Security and Law","host_organization_lineage":["https://openalex.org/P4310316352"],"host_organization_lineage_names":["Association of Digital Forensics, Security and Law"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Digital Forensics, Security and Law","raw_type":"journal-article"},{"id":"pmh:oai:commons.erau.edu:jdfsl-1591","doi":null,"is_oa":true,"landing_page_url":"https://commons.erau.edu/jdfsl/vol14/iss3/1","pdf_url":null,"source":{"id":"https://openalex.org/S4377196356","display_name":"Scholarly Commons (Embry\u2013Riddle Aeronautical University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I84475105","host_organization_name":"Embry\u2013Riddle Aeronautical University","host_organization_lineage":["https://openalex.org/I84475105"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Digital Forensics, Security and Law","raw_type":"text"},{"id":"pmh:oai:napier-surface.worktribe.com:2244476","doi":null,"is_oa":true,"landing_page_url":"https://napier-surface.worktribe.com/2244476/1/Fast%20Forensic%20Triage%20Using%20Centralised%20Thumbnail%20Caches%20on%20Windows%20Operating%20Systems","pdf_url":null,"source":{"id":"https://openalex.org/S4306402591","display_name":"Edinburgh Napier Research Repository (Edinburgh Napier University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I251738","host_organization_name":"Edinburgh Napier University","host_organization_lineage":["https://openalex.org/I251738"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Journal Article"},{"id":"pmh:oai:repository@napier.ac.uk:2244476","doi":null,"is_oa":true,"landing_page_url":"http://researchrepository.napier.ac.uk/Output/2244476","pdf_url":null,"source":{"id":"https://openalex.org/S4306402591","display_name":"Edinburgh Napier Research Repository (Edinburgh Napier University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I251738","host_organization_name":"Edinburgh Napier University","host_organization_lineage":["https://openalex.org/I251738"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":{"id":"doi:10.15394/jdfsl.2019.1591","doi":"https://doi.org/10.15394/jdfsl.2019.1591","is_oa":true,"landing_page_url":"https://doi.org/10.15394/jdfsl.2019.1591","pdf_url":"https://commons.erau.edu/cgi/viewcontent.cgi?article=1591&context=jdfsl","source":{"id":"https://openalex.org/S2764592663","display_name":"The journal of digital forensics, security and law","issn_l":"1558-7215","issn":["1558-7215","1558-7223"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1","poland-20","russia-white-list-4"],"host_organization":"https://openalex.org/P4310316352","host_organization_name":"Association of Digital Forensics, Security and Law","host_organization_lineage":["https://openalex.org/P4310316352"],"host_organization_lineage_names":["Association of Digital Forensics, Security and Law"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Journal of Digital Forensics, Security and Law","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.46149998903274536,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3008985704.pdf","grobid_xml":"https://content.openalex.org/works/W3008985704.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W1457813705","https://openalex.org/W1510021910","https://openalex.org/W1538546197","https://openalex.org/W1993622386","https://openalex.org/W2000577549","https://openalex.org/W2014113877","https://openalex.org/W2043793914","https://openalex.org/W2066500984","https://openalex.org/W2095315533","https://openalex.org/W2114314514","https://openalex.org/W2122196799","https://openalex.org/W2139164455","https://openalex.org/W2151686889","https://openalex.org/W2156350103","https://openalex.org/W2291914331","https://openalex.org/W2739334709","https://openalex.org/W2774251861","https://openalex.org/W2902906303","https://openalex.org/W3145609436","https://openalex.org/W4239074446","https://openalex.org/W4256123662"],"related_works":["https://openalex.org/W2904615716","https://openalex.org/W193377621","https://openalex.org/W2608971871","https://openalex.org/W2139164455","https://openalex.org/W2896262405","https://openalex.org/W389312251","https://openalex.org/W2902906303","https://openalex.org/W6987833997","https://openalex.org/W1487421133","https://openalex.org/W7138194589"],"abstract_inverted_index":{"A":[0,159,236],"common":[1],"investigative":[2,62],"task":[3],"is":[4,167,214],"to":[5,49,59,78,99,175,194,253],"identify":[6],"known":[7,33],"contraband":[8,154,186,258],"images":[9,124],"on":[10,23,125],"a":[11,24,30,89,121,135,143,210],"device,":[12,127],"which":[13,149,169,217],"typically":[14],"involves":[15],"calculating":[16],"cryptographic":[17,156,172,192],"hashes":[18,193],"for":[19,94,129,162,182,191,197],"all":[20],"the":[21,54,60,112,126,139,202,229],"files":[22],"disk":[25,96,268],"and":[26,56,81,255],"checking":[27],"these":[28],"against":[29],"database":[31,165],"of":[32,104,123,138,145,221,239,267],"contraband.":[34],"However,":[35],"modern":[36],"drives":[37],"are":[38,109],"now":[39],"so":[40],"large":[41,61],"that":[42,108,243],"it":[43],"can":[44,57,250],"take":[45],"several":[46],"hours":[47],"just":[48],"read":[50],"this":[51,240],"data":[52],"from":[53,178,201],"disk,":[55],"contribute":[58],"backlogs":[63],"suffered":[64],"by":[65,228,244],"many":[66],"law":[67],"enforcement":[68],"bodies.":[69],"Digital":[70],"forensic":[71,91],"triage":[72,92],"techniques":[73],"may":[74],"thus":[75],"be":[76,176,195,251],"used":[77,252],"prioritise":[79],"evidence":[80,97],"effect":[82],"faster":[83],"investigation":[84],"turnarounds.":[85],"This":[86,132,188],"paper":[87],"proposes":[88],"new":[90,246],"method":[93,161],"investigating":[95],"relating":[98],"picture":[100],"files,":[101],"making":[102],"use":[103,183,220],"centralised":[105,117],"thumbnail":[106,140,185,248],"caches":[107,118,249],"present":[110],"in":[111,184,259],"Windows":[113,199,234],"operating":[114,147],"system.":[115],"Such":[116],"serve":[119],"as":[120],"catalogue":[122],"allowing":[128],"fast":[130],"triage.":[131],"work":[133,241],"includes":[134],"comprehensive":[136],"analysis":[137],"variants":[141],"across":[142,233],"range":[144],"windows":[146],"systems,":[148],"causes":[150],"difficulties":[151],"when":[152],"detecting":[153],"using":[155,245],"hash":[157,164,173],"databases.":[158],"novel":[160,219],"large-scale":[163],"generation":[166],"described":[168],"allows":[170,190],"precalculated":[171],"databases":[174],"built":[177],"arbitrary":[179],"image":[180],"sets":[181],"detection.":[187,208],"approach":[189,213],"generated":[196],"multiple":[198],"versions":[200],"original":[203],"source":[204],"image,":[205],"facilitating":[206],"wider":[207],"Finally,":[209],"more":[211],"flexible":[212],"also":[215],"proposed":[216],"makes":[218],"perceptual":[222],"hashing":[223],"techniques,":[224,247],"mitigating":[225],"issues":[226],"caused":[227],"differences":[230],"between":[231],"thumbnails":[232],"versions.":[235],"key":[237],"contribution":[238],"demonstrates":[242],"robustly":[254],"effectively":[256],"detect":[257],"seconds,":[260],"with":[261],"processing":[262],"times":[263],"being":[264],"largely":[265],"independent":[266],"capacity.":[269]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2020-03-06T00:00:00"}