Computer forensics in forensis
ACM SIGOPS Operating Systems Review
Keith Marzullo
Matt Bishop
Toward a normative approach for forensicability