The DOI matches its Crossref record; 13 of the 14 references it cites were found in a registry or an index.
Guide to integrating forensic techniques into incident response
Open accessAbstract
Reports on Computer Systems TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure.ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology.ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems.This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“A single undetected modification can invalidate an entire chain of evidence and compromise legal admissibility (Kent et al., 2006; International Organization for Standardization, 2012; Stoyanova et al., 2020).”
From Lightweight Tamper-Evident Log Integrity Verification for IoT Edge Environments: A Merkle Tree Pipeline with Adaptive Chunking (2026) · cites this paper as Kent et al., 2006
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“When these logs serve as evidence in forensic investigations, compliance audits, or incident-response workflows, their integrity is not merely desirable; it is a hard prerequisite (Kebande and Venter, 2017; Cichonski et al., 2012; Kent et al., 2006; International Organization for Standardization, 2012).”
From Lightweight Tamper-Evident Log Integrity Verification for IoT Edge Environments: A Merkle Tree Pipeline with Adaptive Chunking (2026) · cites this paper as Kent et al., 2006
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Carrier, B. D. (2005) · Cited by 568
Computer Forensics: Incident Response Essentials
Kruse, W. G., & Heiser, J. G. (2001) · Cited by 361
Digital Evidence and Computer Crime
Casey, E. (2000) · International Linear Collider · Cited by 298
Digital Evidence and Computer Crime
Kizza, J. M., & Kizza, F. M. (2011) · IGI Global eBooks · doi:10.4018/9781599043791.ch015 · Cited by 219
The Tao Of Network Security Monitoring: Beyond Intrusion Detection
Bejtlich, R. (2004) · Virtual Defense Library (Ministerio de Defensa) · Cited by 133
Farmer, D., & Venema, W. (2004) · Cited by 121
Handbook of Computer Crime Investigation : Forensic Tools and Technology
Casey, E. (2001) · Cited by 95
Real Digital Forensics: Computer Security and Incident Response
Jones, K. J., Bejtlich, R., & Rose, C. W. (2005) · Cited by 82
Silence on the wire: a field guide to passive reconnaissance and indirect attacks
(2005) · Choice Reviews Online · doi:10.5860/choice.43-0996 · Cited by 47
Incident Response: Computer Forensics Toolkit
Schweitzer, D. (2003) · Cited by 35
Research works printed but not linked: 2
- Honeynet Project. Know Your Enemy: Learning about Security Threats, Second Edition.
- Prosise, Chris, et al. Incident Response and Computer Forensics, Second Edition. McGraw-Hill Osborne Media, 2003.
Cited by
Sorted by citations
Guide to Industrial Control Systems (ICS) Security
Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015) · doi:10.6028/nist.sp.800-82r2 · Cited by 1,377
Health IT and Patient Safety: Building Safer Systems for Better Care
Chou, D. (2012) · JAMA · doi:10.1001/jama.308.21.2282-a · Cited by 496
Cyber-physical systems security: Limitations, issues and future trends
Yaacoub, J.-P. A., Salman, O., Noura, H., Kaaniche, N., Chehab, A., & Malli, M. A. (2020) · Microprocessors and Microsystems · doi:10.1016/j.micpro.2020.103201 · Cited by 512
Guide to Cyber Threat Information Sharing
Johnson, C. S., Badger, M. L., Waltermire, D., Snyder, J., & Skorupka, C. (2016) · doi:10.6028/nist.sp.800-150 · Cited by 293
An integrated conceptual digital forensic framework for cloud computing
Martini, B., & Choo, K. R. (2012) · Digital Investigation · doi:10.1016/j.diin.2012.07.001 · Cited by 250
Metadata
- Authors
- Kent, K., Chevalier, S., Grance, T., & Dang, H.
- Affiliations
- National Institute of Standards and Technology (US)
- Published
- 2006
- OpenAlex
- W2628759714
- Cited by
- 590
- References
- 14
- Citations by year
- 2026: 33 · 2025: 32 · 2024: 31 · 2023: 36 · 2022: 34 · 2021: 37 · 2020: 52 · 2019: 49 · 2018: 35 · 2017: 40 · 2016: 39 · 2015: 38 · 2014: 38 · 2013: 43 · 2012: 24
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Licence
- public-domain
- Topics
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Law › Education, Law, and Society
- Keywords
- forensic computing, digital forensics, incident response, digital evidence, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
