Forensic analysis of Windows hosts using UNIX-based tools. - Cory Altheide (Digit. Investig., 2004)

Tracking USB storage: Analysis of windows artifacts generated by USB storage devices. - Harlan Carvey; Cory Altheide (Digit. Investig., 2005)

A methodology for the repeatable forensic analysis of encrypted drives. - Cory Altheide; Claudio Merloni; Stefano Zanero (EUROSEC, 2008)