Nicklas Lundblad Digital Evidence. 59-72 2001 conf/i3e/2001 I3E db/conf/i3e/i3e2001.html#Lundblad01