{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T17:00:37Z","timestamp":1726419637745},"reference-count":56,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2023,3,1]],"date-time":"2023-03-01T00:00:00Z","timestamp":1677628800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2022,12,5]],"date-time":"2022-12-05T00:00:00Z","timestamp":1670198400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001292","name":"Edinburgh Napier University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001292","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Forensic Science International: Digital Investigation"],"published-print":{"date-parts":[[2023,3]]},"DOI":"10.1016\/j.fsidi.2022.301486","type":"journal-article","created":{"date-parts":[[2022,12,9]],"date-time":"2022-12-09T22:15:44Z","timestamp":1670624144000},"page":"301486","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":3,"special_numbering":"C","title":["A framework for live host-based Bitcoin wallet forensics and triage"],"prefix":"10.1016","volume":"44","author":[{"given":"Arran","family":"Holmes","sequence":"first","affiliation":[]},{"ORCID":"http:\/\/orcid.org\/0000-0003-0809-3523","authenticated-orcid":false,"given":"William J.","family":"Buchanan","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"author":"Akhgar","key":"10.1016\/j.fsidi.2022.301486_bib1"},{"key":"10.1016\/j.fsidi.2022.301486_bib2","series-title":"\u20182016 Cybersecurity and Cyberforensics Conference (CCC)\u2019","first-page":"41","article-title":"Windows forensic investigations using powerforensics tool","author":"Barakat","year":"2016"},{"key":"10.1016\/j.fsidi.2022.301486_bib4","doi-asserted-by":"crossref","first-page":"S29","DOI":"10.1016\/j.diin.2018.01.005","article-title":"Openforensics: a digital forensics gpu pattern matching approach for the 21st century","volume":"24","author":"Bayne","year":"2018","journal-title":"Digit. Invest."},{"issue":"3","key":"10.1016\/j.fsidi.2022.301486_bib5","first-page":"1","article-title":"Solid state drives: the beginning of the end for current practice in digital forensic recovery?","volume":"5","author":"Bell","year":"2010","journal-title":"J.\u00a0Digit. Foren. Secur. Law"},{"author":"Brown","key":"10.1016\/j.fsidi.2022.301486_bib7"},{"author":"Brown","key":"10.1016\/j.fsidi.2022.301486_bib8"},{"issue":"2","key":"10.1016\/j.fsidi.2022.301486_bib9","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1145\/1113034.1113069","article-title":"Risks of live digital forensic analysis","volume":"49","author":"Carrier","year":"2006","journal-title":"Commun. ACM"},{"key":"10.1016\/j.fsidi.2022.301486_bib10","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1016\/j.diin.2016.12.004","article-title":"Memory forensics: the path forward","volume":"20","author":"Case","year":"2017","journal-title":"Digit. Invest."},{"author":"Chainalysis","key":"10.1016\/j.fsidi.2022.301486_bib11"},{"key":"10.1016\/j.fsidi.2022.301486_bib12","first-page":"1","article-title":"\u2018The back-door governance of crime: confiscating criminal assets in the UK\u2019","author":"Chistyakova","year":"2019","journal-title":"Eur. J. Crim. Pol. Res."},{"issue":"3\u20134","key":"10.1016\/j.fsidi.2022.301486_bib13","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1016\/j.diin.2011.01.001","article-title":"Forensic data recovery from the windows search database","volume":"7","author":"Chivers","year":"2011","journal-title":"Digit. Invest."},{"key":"10.1016\/j.fsidi.2022.301486_bib14","unstructured":"Coinbase (n.d.), \u2018Does coinbase freeze accounts?\u2019. Retrieved August 7, 2021 from https:\/\/help.coinbase.com\/en\/coinbase\/other-topics\/other\/does-coinbase-freeze-accounts."},{"issue":"1","key":"10.1016\/j.fsidi.2022.301486_bib15","first-page":"55","article-title":"Speed optimizations in bitcoin key recovery attacks","volume":"67","author":"Courtois","year":"2016","journal-title":"Tatra Mount. Mathem. Publ. J. Slovak Acad. Sci."},{"issue":"5","key":"10.1016\/j.fsidi.2022.301486_bib17","doi-asserted-by":"crossref","first-page":"1798","DOI":"10.1093\/rfs\/hhz015","article-title":"Sex, drugs, and bitcoin: how much illegal activity is financed through cryptocurrencies?","volume":"32","author":"Foley","year":"2019","journal-title":"Rev. Financ. Stud."},{"issue":"4","key":"10.1016\/j.fsidi.2022.301486_bib18","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1016\/S1353-4858(04)00067-4","article-title":"The importance of text searches in digital forensics","volume":"2004","author":"Forte","year":"2004","journal-title":"Netw. Secur."},{"author":"Gabbatt","key":"10.1016\/j.fsidi.2022.301486_bib19"},{"key":"10.1016\/j.fsidi.2022.301486_bib20","series-title":"AISM 2015 : Proceedings of the 13th Australian Information Security Management Conference","first-page":"47","article-title":"Ransomware: emergence of the cyber-extortion menace","author":"Hampton","year":"2015"},{"author":"Hashcat","key":"10.1016\/j.fsidi.2022.301486_bib21"},{"author":"Heutmaker","key":"10.1016\/j.fsidi.2022.301486_bib22"},{"issue":"1","key":"10.1016\/j.fsidi.2022.301486_bib23","doi-asserted-by":"crossref","first-page":"4","DOI":"10.3390\/computation8010004","article-title":"Gpu computing with python: performance, energy efficiency and usability","volume":"8","author":"Holm","year":"2020","journal-title":"Computation"},{"issue":"1","key":"10.1016\/j.fsidi.2022.301486_bib26","doi-asserted-by":"crossref","first-page":"82","DOI":"10.7763\/JACN.2015.V3.146","article-title":"Comparative analysis of digital forensic models","volume":"3","author":"Jafari","year":"2015","journal-title":"J.\u00a0Adv. Comput. Netw."},{"key":"10.1016\/j.fsidi.2022.301486_bib27","series-title":"Adjunct Publication of the 27th Conference on User Modeling, Adaptation and Personalization","first-page":"203","article-title":"Towards designing advanced password cracking toolkits: optimizing the password cracking process","author":"Jourdan","year":"2019"},{"issue":"14","key":"10.1016\/j.fsidi.2022.301486_bib28","first-page":"800","article-title":"Guide to integrating forensic techniques into incident response","volume":"10","author":"Kent","year":"2006","journal-title":"NIST Spec. Publ."},{"key":"10.1016\/j.fsidi.2022.301486_bib29","unstructured":"Kent Police (n.d.), \u2018Investigate first - progression opportunities\u2019. Retrieved July 21, 2021 from https:\/\/www.kent.police.uk\/police-forces\/kent-police\/areas\/kent-police\/c\/careers\/police-officers\/new-investigate-first\/progression-opportunities\/."},{"author":"Kholia","key":"10.1016\/j.fsidi.2022.301486_bib30"},{"key":"10.1016\/j.fsidi.2022.301486_bib31","unstructured":"Ledger (n.d.), \u2018Hardware wallet comparison\u2019. Retrieved August 7, 2021 from https:\/\/shop.ledger.com\/pages\/hardware-wallets-comparison."},{"key":"10.1016\/j.fsidi.2022.301486_bib32","doi-asserted-by":"crossref","first-page":"228","DOI":"10.1163\/157181797X00347","article-title":"Taking the profit out of crime: the UK experience","volume":"5","author":"Levi","year":"1997","journal-title":"Eur. J. Crime Crim. Law Crim. Justice"},{"author":"Microsoft","key":"10.1016\/j.fsidi.2022.301486_bib33"},{"key":"10.1016\/j.fsidi.2022.301486_bib34","article-title":"Bitcoin: a peer-to-peer electronic cash system","author":"Nakamoto","year":"2008","journal-title":"Decentral. Bus. Rev."},{"author":"Palatinus","key":"10.1016\/j.fsidi.2022.301486_bib39"},{"key":"10.1016\/j.fsidi.2022.301486_bib40","article-title":"Use of the web api as a basis for obtaining the latest data on bitcoin prices at 30 exchange places","volume":"vol. 1125","author":"Parlika","year":"2021"},{"key":"10.1016\/j.fsidi.2022.301486_bib41","series-title":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","first-page":"295","article-title":"Let's go in for a closer look: observing passwords in their natural habitat","author":"Pearman","year":"2017"},{"author":"Povey","key":"10.1016\/j.fsidi.2022.301486_bib42"},{"issue":"10","key":"10.1016\/j.fsidi.2022.301486_bib45","first-page":"1048","article-title":"Exploring static and live digital forensics: methods, practices and tools","volume":"4","author":"Rafique","year":"2013","journal-title":"Int. J. Sci. Eng. Res."},{"issue":"1","key":"10.1016\/j.fsidi.2022.301486_bib46","first-page":"10","article-title":"Ransomware: evolution, mitigation and prevention","volume":"13","author":"Richardson","year":"2017","journal-title":"Int. Manag. Rev."},{"author":"Rothery","key":"10.1016\/j.fsidi.2022.301486_bib47"},{"key":"10.1016\/j.fsidi.2022.301486_bib48","series-title":"10th {USENIX} Workshop on Offensive Technologies ({WOOT} 16)","article-title":"Acceleration attacks on pbkdf2: or, what is inside the black-box of oclhashcat?","author":"Ruddick","year":"2016"},{"author":"Rusnak","key":"10.1016\/j.fsidi.2022.301486_bib49"},{"author":"Russinovich","key":"10.1016\/j.fsidi.2022.301486_bib50"},{"key":"10.1016\/j.fsidi.2022.301486_bib51","series-title":"2019 31st International Conference on Microelectronics (ICM)","first-page":"130","article-title":"Practical side-channel attack on a security device","author":"San Pedro","year":"2019"},{"issue":"3","key":"10.1016\/j.fsidi.2022.301486_bib53","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","article-title":"A\u00a0mathematical theory of communication","volume":"27","author":"Shannon","year":"1948","journal-title":"Bell Syst. Tech. J."},{"key":"10.1016\/j.fsidi.2022.301486_bib54","unstructured":"Sofer, N. (n.d.), \u2018Nirsoft Utilities\u2019. Retrieved August 15, 2021 from https:\/\/www.nirsoft.net\/."},{"key":"10.1016\/j.fsidi.2022.301486_bib56","article-title":"Memory foreshadow: memory forensics of hardware cryptocurrency wallets\u2013a tool and visualization framework","volume":"33","author":"Thomas","year":"2020","journal-title":"Forensic Sci. Int.: Digit. Invest."},{"issue":"4","key":"10.1016\/j.fsidi.2022.301486_bib57","doi-asserted-by":"crossref","first-page":"92","DOI":"10.1109\/MSP.2018.3111243","article-title":"Cryptocurrencies\u2014a forensic challenge or opportunity for law enforcement? an interpol perspective","volume":"16","author":"Tziakouris","year":"2018","journal-title":"IEEE Secur. Priv."},{"key":"10.1016\/j.fsidi.2022.301486_bib58","doi-asserted-by":"crossref","first-page":"22385","DOI":"10.1109\/ACCESS.2017.2759766","article-title":"Process memory investigation of the bitcoin clients electrum and bitcoin core","volume":"5","author":"Van Der Horst","year":"2017","journal-title":"IEEE Access"},{"key":"10.1016\/j.fsidi.2022.301486_bib59","series-title":"International Conference on Financial Cryptography and Data Security","first-page":"609","article-title":"The bitcoin brain drain: examining the use and abuse of bitcoin brain wallets","author":"Vasek","year":"2016"},{"key":"10.1016\/j.fsidi.2022.301486_bib60","series-title":"International Conference on Cryptology and Network Security","first-page":"119","article-title":"On the weaknesses of pbkdf2","author":"Visconti","year":"2015"},{"key":"10.1016\/j.fsidi.2022.301486_bib61","first-page":"296","article-title":"Examining pbkdf2 security margin\u2014case study of luks","volume":"46","author":"Visconti","year":"2019","journal-title":"J.\u00a0Inf. Secur. Appl."},{"key":"10.1016\/j.fsidi.2022.301486_bib62","doi-asserted-by":"crossref","first-page":"136","DOI":"10.1016\/j.future.2018.08.029","article-title":"Cracking bitcoin wallets: I want what you have in the wallets","volume":"91","author":"Volety","year":"2019","journal-title":"Future Generat. Comput. Syst."},{"key":"10.1016\/j.fsidi.2022.301486_bib63","series-title":"Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy","first-page":"196","article-title":"The next domino to fall: empirical analysis of user passwords across online services","author":"Wang","year":"2018"},{"issue":"3","key":"10.1016\/j.fsidi.2022.301486_bib64","doi-asserted-by":"crossref","first-page":"346","DOI":"10.1007\/s12117-019-09365-8","article-title":"Criminal markets: the dark web, money laundering and counterstrategies-an overview of the 10th research conference on organized crime","volume":"22","author":"Weber","year":"2019","journal-title":"Trends Organ. Crime"},{"key":"10.1016\/j.fsidi.2022.301486_bib65","series-title":"2009 30th IEEE Symposium on Security and Privacy","first-page":"391","article-title":"Password cracking using probabilistic context-free grammars","author":"Weir","year":"2009"},{"author":"Williams","key":"10.1016\/j.fsidi.2022.301486_bib66"},{"author":"Wuille","key":"10.1016\/j.fsidi.2022.301486_bib67"},{"key":"10.1016\/j.fsidi.2022.301486_bib68","series-title":"International Conference on Digital Forensics and Cyber Crime","first-page":"53","article-title":"Forensically sound retrieval and recovery of images from gpu memory","author":"Zhang","year":"2015"},{"key":"10.1016\/j.fsidi.2022.301486_bib69","doi-asserted-by":"crossref","first-page":"158250","DOI":"10.1109\/ACCESS.2019.2948774","article-title":"An automated live forensic and postmortem analysis tool for bitcoin on windows systems","volume":"7","author":"Zollner","year":"2019","journal-title":"IEEE Access"}],"container-title":["Forensic Science International: Digital Investigation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281722001676?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2666281722001676?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2024,6,29]],"date-time":"2024-06-29T13:56:35Z","timestamp":1719669395000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2666281722001676"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3]]},"references-count":56,"alternative-id":["S2666281722001676"],"URL":"https:\/\/doi.org\/10.1016\/j.fsidi.2022.301486","relation":{},"ISSN":["2666-2817"],"issn-type":[{"type":"print","value":"2666-2817"}],"subject":[],"published":{"date-parts":[[2023,3]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A framework for live host-based Bitcoin wallet forensics and triage","name":"articletitle","label":"Article Title"},{"value":"Forensic Science International: Digital Investigation","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.fsidi.2022.301486","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"Crown Copyright \u00a9 2022 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"301486"}}