A correlation method for establishing provenance of timestamps in digital evidence. - Schatz, Bradley L.; Mohay, George M.; Clark, Andrew J. (Digit. Investig., 2006)