Two Models of Digital Forensic Examination
Fred Cohen · 2009
This paper examines an existing cost model of digital forensic evidence examination, identifies minor optimization improvements to that model, describes a new model, and uses the new model to show some fundamental theoretical limits of examination.