% This file was created with JabRef 2.10b2.
% Encoding: ISO8859_1

@MastersThesis{Leigh2015ForensicTimelineAnalysisoftheZettabyteFileSystem,
  Title                    = {Forensic Timeline Analysis of the Zettabyte File System},
  Author                   = {Dylan Leigh},
  School                   = {College of Engineering and Science, Victoria University},
  Year                     = {2015},
  Month                    = {January},

  Abstract                 = {During forensic analysis of computer systems, it is often necessary to construct a chronological account of events, including when files were created, modified, accessed and deleted. Timeline analysis is the process of collating and analysing this data, using timestamps from the filesystem and other sources such as log files and internal file metadata.
The Zettabyte File System (ZFS) uses a novel and complex structure to store file data and metadata across multiple devices. Due to the unusual structure and operation of ZFS, many existing forensic tools and techniques cannot be used to analyse ZFS filesystems.
In this project, it has been demonstrated that four of the internal structures of ZFS can be used as effective sources of timeline information. Methods to extract these structures and use them for timeline analysis are provided, including al- gorithms to detect falsified file timestamps and to determine when individual blocks of file data were last modified.},
  Owner                    = {dleigh},
  Timestamp                = {2015.01.17},
  Url                      = {http://research.dylanleigh.net/zfs-timeline-forensics/dleigh-final-honours-thesis-ZFS-Timeline.pdf}
}

@Article{Leigh2014AddingZFSEventstoaSuperTimeline,
  Title                    = {Adding ZFS Events to a Super-Timeline},
  Author                   = {Dylan Leigh and Hao Shi},
  Journal                  = {Digital Forensics Magazine},
  Year                     = {2014},

  Month                    = {August},
  Number                   = {20},

  Abstract                 = {The Zettabyte File System (ZFS), a relatively new and unusual filesystem, uses an object tree to store files and metadata across a pool of disks. Many existing forensics tools and techniques cannot be used to analyse ZFS filesystems due to their unusual structure and operation. Based upon our research into ZFS timeline forensics, we have developed two new parsers for the Plaso timeline analysis software to parse ZFS Debugger (ZDB) output and add ZFS events to a Plaso super-timeline.},
  Timestamp                = {2014.08.01},
  Url                      = {http://research.dylanleigh.net/zfs-timeline-forensics/plaso-zdb/}
}

@InProceedings{Leigh2014ZFSTimelineForensics,
  Title                    = {Forensic Timestamp Analysis of ZFS},
  Author                   = {Dylan Leigh and Hao Shi},
  Booktitle                = {BSDCan 2014},
  Year                     = {2014},
  Month                    = {May},
  Organization             = {BSDCan},

  Abstract                 = {During forensic analysis of disks, it may be desirable to construct an account of events over time, including when files were created, modified, accessed and deleted. "Timeline analysis" is the process of collating this data, using file timestamps from the file system and other sources such as log files and internal file metadata. The Zettabyte File System (ZFS) uses a complex structure to store file data and metadata and the many internal structures of ZFS are another source of timeline information. This internal metadata can also be used to detect timestamps which have been tampered with by the touch command or by changing the system clock.},
  Owner                    = {dleigh},
  Timestamp                = {2014.05.10},
  Url                      = {http://www.bsdcan.org/2014/schedule/events/464.en.html}
}

@Misc{Leigh2014ZFSTimelineForensicsQuickReference,
  Title                    = {ZFS Timeline Forensics Quick Reference},

  Author                   = {Dylan Leigh},
  Month                    = {May},
  Year                     = {2014},

  Owner                    = {dleigh},
  Timestamp                = {2014.05.10},
  Url                      = {http://www.research.dylanleigh.net/zfs-bsdcan-2014/zfs-timeline-quickref.pdf}
}


@TechReport{DylanLeigh2012ATestBedforDataHidinginFinancialTransactions,
  Title                    = {A Test Bed for Data Hiding in Financial Transactions},
  Author                   = {Dylan Leigh, Ron van Schyndel},
  Institution              = {RMIT University},
  Year                     = {2012},
  Month                    = {February},

  Abstract                 = {The aim of this project is to develop a framework to allow experiments with data hiding in financial transactions, and for detecting the use of information hiding in financial transactions. An analysis is made of electronic funds transfer systems in use within Australia, particularly those used for direct credit transactions. A model of financial transaction networks based on Australian systems is developed and a simulator framework which implements the model described is developed for conducting further research. Several example data hiding techniques and scenarios are presented.},
  Url                      = {http://www.dylanleigh.net/portfolio/s3017239-summer-summary.pdf}
}

@TechReport{DylanLeigh2010Counteringtheuseofnon-repudiationmethodstocompromiseprivacy,
  Title                    = {Countering the use of non-repudiation methods to compromise privacy},
  Author                   = {Dylan Leigh, Ron van Schyndel},
  Institution              = {RMIT University},
  Year                     = {2010},
  Month                    = {October},
  Type                     = {Literature Review},

  Abstract                 = {This report examines ways in which non-repudiation mechanisms can be exploited to compromise the anonymity or privacy of their users. Some of the possible consequences of privacy breaches are discussed, and an overview of Australian privacy legislation is provided. Two non-repudiation techniques which allow customers to remain anonymous and keep their communications private are explored.},
  HowPublished             = {http://www.dylanleigh.net/portfolio/s3017239-cif-alt-assess.pdf},
  Url                      = {http://www.dylanleigh.net/portfolio/s3017239-cif-alt-assess.pdf}
}