# Assoc. Prof. Mark Scanlon

Digital forensics and cybersecurity research, teaching, publications, and supervision by Assoc. Prof. Mark Scanlon, Associate Professor in the School of Computer Science at University College Dublin.

Website: https://markscanlon.co/
Publications: https://markscanlon.co/publications/
Sitemap: https://markscanlon.co/sitemap.xml
Full publication guide: https://markscanlon.co/llms-full.txt

## Core Pages

- [Research](https://markscanlon.co/research/)
- [Publications](https://markscanlon.co/publications/)
- [Teaching](https://markscanlon.co/teaching/)
- [Professional Service](https://markscanlon.co/professional/)
- [Prospective PhD Students](https://markscanlon.co/prospective-students/)
- [Contact / Collaborate](https://markscanlon.co/collaborate/)

## Publications
- [Objects as Universal Geolocation Cues: A Computer Vision Approach](https://markscanlon.co/publications/ObjectsAsUniversalGeolocationCues.html) (2026). PDF: https://markscanlon.co/publications/ObjectsAsUniversalGeolocationCues.pdf
- [VAAS: Vision-Attention Anomaly Scoring for image manipulation detection in digital forensics](https://markscanlon.co/publications/VisionAttentionAnomolyScoringImageManipulationDetection.html) (2026). DOI: https://doi.org/10.1016/j.fsidi.2026.302063. PDF: https://markscanlon.co/publications/VisionAttentionAnomolyScoringImageManipulationDetection.pdf
- [Plug to place: Indoor multimedia geolocation from electrical sockets for digital investigation](https://markscanlon.co/publications/PlugToPlace-IndoorMultimediaGeolocation.html) (2026). DOI: https://doi.org/10.1016/j.fsidi.2026.302056. PDF: https://markscanlon.co/publications/PlugToPlace-IndoorMultimediaGeolocation.pdf
- [Investigation of large language models, GenAI, and proprietary AI systems: Digital forensic evidence, readiness and regulation](https://markscanlon.co/publications/Editorial-InvestigationofLargeLanguageModelsGenAIandProprietaryAISystems.html) (2026). DOI: https://doi.org/10.1016/j.fsidi.2026.302135. PDF: https://markscanlon.co/publications/Editorial-InvestigationofLargeLanguageModelsGenAIandProprietaryAISystems.pdf
- [AutoDFBench 1.0: A benchmarking framework for digital forensic tool testing and generated code evaluation](https://markscanlon.co/publications/AutoDFBench1.0DigitalForensicToolTesting.html) (2026). DOI: https://doi.org/10.1016/j.fsidi.2026.302055. PDF: https://markscanlon.co/publications/AutoDFBench1.0DigitalForensicToolTesting.pdf
- [Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis](https://markscanlon.co/publications/LLM-based-Digital-Forensic-Timeline-Analysis.html) (2025). DOI: https://doi.org/10.1016/j.fsidi.2025.301982. PDF: https://markscanlon.co/publications/LLM-based-Digital-Forensic-Timeline-Analysis.pdf
- [An AI-Based Network Forensic Readiness Framework for Resource-Constrained Environments](https://markscanlon.co/publications/NetworkForensicReadinessResourceContrainedEnvironments.html) (2025). DOI: https://doi.org/10.1007/978-3-032-00635-6_6. PDF: https://markscanlon.co/publications/NetworkForensicReadinessResourceContrainedEnvironments.pdf
- [Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations](https://markscanlon.co/publications/Fine-Tuning-Large-Language-Models-for-Digital-Forensics.html) (2025). DOI: https://doi.org/10.1145/3748264. PDF: https://markscanlon.co/publications/Fine-Tuning-Large-Language-Models-for-Digital-Forensics.pdf
- [Low-overhead and Non-invasive Electromagnetic Side-Channel Monitoring for Forensic-ready Industrial Control Systems](https://markscanlon.co/publications/EM-SCAForensicReadinessICS.html) (2025). DOI: https://doi.org/10.1145/3712716.3712722. PDF: https://markscanlon.co/publications/EM-SCAForensicReadinessICS.pdf
- [Improving Image Embeddings with Colour Features in Indoor Scene Geolocation](https://markscanlon.co/publications/ImageEmbeddingsColourFeaturesIndoorGeolocation.html) (2025). DOI: https://doi.org/10.1109/ACCESS.2025.3564496. PDF: https://markscanlon.co/publications/ImageEmbeddingsColourFeaturesIndoorGeolocation.pdf
- [AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation](https://markscanlon.co/publications/AutoDFBenchDigitalForensicCodeTesting.html) (2025). DOI: https://doi.org/10.1145/3712716.3712718. PDF: https://markscanlon.co/publications/AutoDFBenchDigitalForensicCodeTesting.pdf
- [Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency](https://markscanlon.co/publications/Survey-Large-Language-Models-Digital-Forensics.html) (2025). DOI: https://doi.org/10.1016/j.fsidi.2024.301859. PDF: https://markscanlon.co/publications/Survey-Large-Language-Models-Digital-Forensics.pdf
- [Pushing Network Forensic Readiness to the Edge: A Resource Constrained Artificial Intelligence Based Methodology](https://markscanlon.co/publications/PushingNetworkForensicReadinessToTheEdge.html) (2024). DOI: https://doi.org/10.1109/Cyber-RCI60769.2024.10939120. PDF: https://markscanlon.co/publications/PushingNetworkForensicReadinessToTheEdge.pdf
- [Perceptual Colour-based Geolocation of Human Trafficking Images for Digital Forensic Investigation](https://markscanlon.co/publications/PerceptualColour-BasedImageGeolocation.html) (2024). DOI: https://doi.org/10.1109/Cyber-RCI60769.2024.10941203. PDF: https://markscanlon.co/publications/PerceptualColour-BasedImageGeolocation.pdf
- [Context Based Password Cracking Dictionary Expansion Using Generative Pre-trained Transformers](https://markscanlon.co/publications/ContextPasswordCrackingUsingGPTs.html) (2024). DOI: https://doi.org/10.1109/Cyber-RCI60769.2024.10939663. PDF: https://markscanlon.co/publications/ContextPasswordCrackingUsingGPTs.pdf
- [A Comprehensive Evaluation on the Benefits of Context Based Password Cracking for Digital Forensics](https://markscanlon.co/publications/BenefitsOfContextBasedPasswordCracking.html) (2024). DOI: https://doi.org/10.1016/j.jisa.2024.103809. PDF: https://markscanlon.co/publications/BenefitsOfContextBasedPasswordCracking.pdf
- [Revealing IoT Cryptographic Settings through Electromagnetic Side-Channel Analysis](https://markscanlon.co/publications/IoTCryptoEM-SCA.html) (2024). DOI: https://doi.org/10.3390/electronics13081579. PDF: https://markscanlon.co/publications/IoTCryptoEM-SCA.pdf
- [A Framework for Integrated Digital Forensic Investigation Employing AutoGen AI Agents](https://markscanlon.co/publications/DigitalForensicsAutoGenAI.html) (2024). DOI: https://doi.org/10.1109/ISDFS60797.2024.10527235. PDF: https://markscanlon.co/publications/DigitalForensicsAutoGenAI.pdf
- [A Digital Forensic Methodology for Encryption Key Recovery from Black-Box IoT Devices](https://markscanlon.co/publications/BlackBoxIoTEncryptionKeyRecovery.html) (2024). DOI: https://doi.org/10.1109/ISDFS60797.2024.10527284. PDF: https://markscanlon.co/publications/BlackBoxIoTEncryptionKeyRecovery.pdf
- [Ensuring Cross-Device Portability of Electromagnetic Side-Channel Analysis for Digital Forensics](https://markscanlon.co/publications/CrossDevicePortabilityEMSCA.html) (2024). DOI: https://doi.org/10.1016/j.fsidi.2023.301684. PDF: https://markscanlon.co/publications/CrossDevicePortabilityEMSCA.pdf
- [DFRWS EU 10-Year Review and Future Directions in Digital Forensic Research](https://markscanlon.co/publications/10YearReviewAndFutureDirectionsDigitalForensic.html) (2024). DOI: https://doi.org/10.1016/j.fsidi.2023.301685. PDF: https://markscanlon.co/publications/10YearReviewAndFutureDirectionsDigitalForensic.pdf
- [DFPulse: The 2024 digital forensic practitioner survey](https://markscanlon.co/publications/DFPulse2024DigitalForensicPractitionerSurvey.html) (2024). DOI: https://doi.org/10.1016/j.fsidi.2024.301844. PDF: https://markscanlon.co/publications/DFPulse2024DigitalForensicPractitionerSurvey.pdf
- [An Evaluation of AI-Based Network Intrusion Detection in Resource-Constrained Environments](https://markscanlon.co/publications/AIIntrusionDetectionResourceConstrained.html) (2023). DOI: https://doi.org/10.1109/UEMCON59035.2023.10315971. PDF: https://markscanlon.co/publications/AIIntrusionDetectionResourceConstrained.pdf
- [Context-Based Password Cracking for Digital Investigation](https://markscanlon.co/publications/PhDThesis-ContextBasedPasswordCrackingForDigitalInvestigation.html) (2023). PDF: https://markscanlon.co/publications/PhDThesis-ContextBasedPasswordCrackingForDigitalInvestigation.pdf
- [Harder, Better, Faster, Stronger: Optimising the Performance of Context-Based Password Cracking Dictionaries](https://markscanlon.co/publications/OptimisingPasswordCrackingDictionaries.html) (2023). DOI: https://doi.org/10.1016/j.fsidi.2023.301507. PDF: https://markscanlon.co/publications/OptimisingPasswordCrackingDictionaries.pdf
- [Digital forensic investigation in the age of ChatGPT](https://markscanlon.co/publications/ChatGPT.html) (2023). DOI: https://doi.org/10.1016/j.fsidi.2023.301543. PDF: https://markscanlon.co/publications/ChatGPT.pdf
- [ChatGPT for digital forensic investigation: The good, the bad, and the unknown](https://markscanlon.co/publications/ChatGPTforDigitalForensics.html) (2023). DOI: https://doi.org/10.1016/j.fsidi.2023.301609. PDF: https://markscanlon.co/publications/ChatGPTforDigitalForensics.pdf
- [Deep Learning Based Network Intrusion Detection System for Resource-Constrained Environments](https://markscanlon.co/publications/DLNIDS.html) (2022). DOI: https://doi.org/10.1007/978-3-031-36574-4_21. PDF: https://markscanlon.co/publications/DLNIDS.pdf
- [Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems](https://markscanlon.co/publications/DataExfiltrationEM-SCA.html) (2022). DOI: https://doi.org/10.3390/app13052928. PDF: https://markscanlon.co/publications/DataExfiltrationEM-SCA.pdf
- [Application of Artificial Intelligence to Network Forensics: Survey, Challenges and Future Directions](https://markscanlon.co/publications/AIforNetworkForensics.html) (2022). DOI: https://doi.org/10.1109/ACCESS.2022.3214506. PDF: https://markscanlon.co/publications/AIforNetworkForensics.pdf
- [Security, Ethics and Privacy Issues in Remote Extended Reality for Education](https://markscanlon.co/publications/SecurityEthicsXREducation.html) (2022). DOI: https://doi.org/10.1007/978-981-99-4958-8_16
- [A Novel Dictionary Generation Methodology for Contextual-Based Password Cracking](https://markscanlon.co/publications/MethodologyContextual-BasedPasswordCracking.html) (2022). DOI: https://doi.org/10.1109/ACCESS.2022.3179701. PDF: https://markscanlon.co/publications/MethodologyContextual-BasedPasswordCracking.pdf
- [PCWQ: A Framework for Evaluating Password Cracking Wordlist Quality](https://markscanlon.co/publications/PasswordCrackingWordlistQuality.html) (2021). DOI: https://doi.org/10.1007/978-3-031-06365-7_10. PDF: https://markscanlon.co/publications/PasswordCrackingWordlistQuality.pdf
- [Identifying Internet of Things Software Activities using Deep Learning-based Electromagnetic Side-Channel Analysis](https://markscanlon.co/publications/IoT-DL-EMSCA.html) (2021). DOI: https://doi.org/10.1016/j.fsidi.2021.301308. PDF: https://markscanlon.co/publications/IoT-DL-EMSCA.pdf
- [How Viable is Password Cracking in Digital Forensic Investigation? Analyzing the Guessability of over 3.9 Billion Real-World Accounts](https://markscanlon.co/publications/PasswordCracking3BillionAccounts.html) (2021). DOI: https://doi.org/10.1016/j.fsidi.2021.301186. PDF: https://markscanlon.co/publications/PasswordCracking3BillionAccounts.pdf
- [Digital Forensics: Leveraging Deep Learning Techniques in Facial Images to Assist Cybercrime Investigations](https://markscanlon.co/publications/PhDThesis-DeepLearningFacialImageCybercrime.html) (2021). PDF: https://markscanlon.co/publications/PhDThesis-DeepLearningFacialImageCybercrime.pdf
- [Vec2UAge: Enhancing Underage Age Estimation Performance through Facial Embeddings](https://markscanlon.co/publications/Vec2UAge.html) (2021). DOI: https://doi.org/10.1016/j.fsidi.2021.301119. PDF: https://markscanlon.co/publications/Vec2UAge.pdf
- [TraceGen: User Activity Emulation for Digital Forensic Test Image Generation](https://markscanlon.co/publications/TraceGen.html) (2021). DOI: https://doi.org/10.1016/j.fsidi.2021.301133. PDF: https://markscanlon.co/publications/TraceGen.pdf
- [A Comparative Study of Support Vector Machine and Neural Networks for File Type Identification Using n-gram Analysis](https://markscanlon.co/publications/FileIdentification.html) (2021). DOI: https://doi.org/10.1016/j.fsidi.2021.301121. PDF: https://markscanlon.co/publications/FileIdentification.pdf
- [On Offloading Network Forensic Analytics to Programmable Data Plane Switches](https://markscanlon.co/publications/NetworkForensicAnalytics.html) (2021). PDF: https://markscanlon.co/publications/NetworkForensicAnalytics.pdf
- [A Survey Exploring Open Source Intelligence for Smarter Password Cracking](https://markscanlon.co/publications/SurveyOSINTPasswordCracking.html) (2020). DOI: https://doi.org/10.1016/j.fsidi.2020.301075. PDF: https://markscanlon.co/publications/SurveyOSINTPasswordCracking.pdf
- [Retracing the Flow of the Stream: Investigating Kodi Streaming Services](https://markscanlon.co/publications/Kodi-XBMC-Forensics.html) (2020). DOI: https://doi.org/10.1007/978-3-030-68734-2_13. PDF: https://markscanlon.co/publications/Kodi-XBMC-Forensics.pdf
- [Electromagnetic Side-Channel Analysis Methods for Digital Forensics on Internet of Things](https://markscanlon.co/publications/PhDThesis-ElectromagneticSideChannelAnalysisIoT.html) (2020). PDF: https://markscanlon.co/publications/PhDThesis-ElectromagneticSideChannelAnalysisIoT.pdf
- [Alleviating the Digital Forensic Backlog: A Methodology for Automated Digital Evidence Processing](https://markscanlon.co/publications/PhDThesis-MethodologyAutomatedDigitalEvidenceProcessing.html) (2020). PDF: https://markscanlon.co/publications/PhDThesis-MethodologyAutomatedDigitalEvidenceProcessing.pdf
- [SoK: Exploring the State of the Art and the Future Potential of Artificial Intelligence in Digital Forensic Investigation](https://markscanlon.co/publications/SoK-AI-Forensics.html) (2020). DOI: https://doi.org/10.1145/3407023.3407068. PDF: https://markscanlon.co/publications/SoK-AI-Forensics.pdf
- [Facilitating Electromagnetic Side-Channel Analysis for IoT Investigation: Evaluating the EMvidence Framework](https://markscanlon.co/publications/EvaluatingEMvidence.html) (2020). DOI: https://doi.org/10.1016/j.fsidi.2020.301003. PDF: https://markscanlon.co/publications/EvaluatingEMvidence.pdf
- [Smarter Password Guessing Techniques Leveraging Contextual Information and OSINT](https://markscanlon.co/publications/SmarterPasswordGuessing.html) (2020). DOI: https://doi.org/10.1109/CyberSecurity49315.2020.9138870. PDF: https://markscanlon.co/publications/SmarterPasswordGuessing.pdf
- [Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events](https://markscanlon.co/publications/ArtefactRelevancy.html) (2020). DOI: https://doi.org/10.1109/CyberSecurity49315.2020.9138874. PDF: https://markscanlon.co/publications/ArtefactRelevancy.pdf
- [Assessing the Influencing Factors on the Accuracy of Underage Facial Age Estimation](https://markscanlon.co/publications/AssessingInfluencingFactorsAgeEstimation.html) (2020). DOI: https://doi.org/10.1109/CyberSecurity49315.2020.9138851. PDF: https://markscanlon.co/publications/AssessingInfluencingFactorsAgeEstimation.pdf
- [EMvidence: A Framework for Digital Evidence Acquisition from IoT Devices through Electromagnetic Side-Channel Analysis](https://markscanlon.co/publications/EMvidence.html) (2020). DOI: https://doi.org/10.1016/j.fsidi.2020.300907. PDF: https://markscanlon.co/publications/EMvidence.pdf
- [DeepUAge: Improving Underage Age Estimation Accuracy to Aid CSEM Investigation](https://markscanlon.co/publications/UnderageFacialAgeEstimation.html) (2020). DOI: https://doi.org/10.1016/j.fsidi.2020.300921. PDF: https://markscanlon.co/publications/UnderageFacialAgeEstimation.pdf
- [Cutting through the Emissions: Feature Selection from Electromagnetic Side-Channel Data for Activity Detection](https://markscanlon.co/publications/EMSideChannelFeatureSelection.html) (2020). DOI: https://doi.org/10.1016/j.fsidi.2020.300927. PDF: https://markscanlon.co/publications/EMSideChannelFeatureSelection.pdf
- [Methodology for the Automated Metadata-Based Classification of Incriminating Digital Forensic Artefacts](https://markscanlon.co/publications/AutomatedClassificationArtefacts.html) (2019). DOI: https://doi.org/10.1145/3339252.3340517. PDF: https://markscanlon.co/publications/AutomatedClassificationArtefacts.pdf
- [Improving Borderline Adulthood Facial Age Estimation through Ensemble Learning](https://markscanlon.co/publications/BorderlineAdulthoodAgeEstimation.html) (2019). DOI: https://doi.org/10.1145/3339252.3341491. PDF: https://markscanlon.co/publications/BorderlineAdulthoodAgeEstimation.pdf
- [Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices](https://markscanlon.co/publications/LeveragingEMIoT.html) (2019). DOI: https://doi.org/10.1016/j.diin.2019.04.012. PDF: https://markscanlon.co/publications/LeveragingEMIoT.pdf
- [A Survey of Electromagnetic Side-Channel Attacks and Discussion on their Case-Progressing Potential for Digital Forensics](https://markscanlon.co/publications/SurveyEMSideChannelsForensics.html) (2019). DOI: https://doi.org/10.1016/j.diin.2019.03.002. PDF: https://markscanlon.co/publications/SurveyEMSideChannelsForensics.pdf
- [Shining a light on Spotlight: Leveraging Apple's desktop search utility to recover deleted file metadata on macOS](https://markscanlon.co/publications/SpotlightMacForensics.html) (2019). DOI: https://doi.org/10.1016/j.diin.2019.01.019. PDF: https://markscanlon.co/publications/SpotlightMacForensics.pdf
- [Improving the Accuracy of Automated Facial Age Estimation to Aid CSEM Investigations](https://markscanlon.co/publications/FacialAgeEstimationPoster.html) (2019). DOI: https://doi.org/10.1016/j.diin.2019.01.024. PDF: https://markscanlon.co/publications/FacialAgeEstimationPoster.pdf
- [Solid State Drive Forensics: Where Do We Stand?](https://markscanlon.co/publications/SSDForensics.html) (2019). DOI: https://doi.org/10.1007/978-3-030-05487-8_8. PDF: https://markscanlon.co/publications/SSDForensics.pdf
- [Enabling the Non-Expert Analysis of Large Volumes of Intercepted Network Traffic](https://markscanlon.co/publications/NetworkIntell.html) (2018). DOI: https://doi.org/10.1007/978-3-319-99277-8_11. PDF: https://markscanlon.co/publications/NetworkIntell.pdf
- [Deduplicated Disk Image Evidence Acquisition and Forensically-Sound Reconstruction](https://markscanlon.co/publications/ForensicallySoundReconstruction.html) (2018). DOI: https://doi.org/10.1109/TrustCom/BigDataSE.2018.00249. PDF: https://markscanlon.co/publications/ForensicallySoundReconstruction.pdf
- [Cloud Investigations of Illegal IPTV Networks](https://markscanlon.co/publications/IllegalIPTVNetworks.html) (2018). DOI: https://doi.org/10.1109/TrustCom/BigDataSE.2018.00295. PDF: https://markscanlon.co/publications/IllegalIPTVNetworks.pdf
- [Accuracy Enhancement of Electromagnetic Side-channel Attacks on Computer Monitors](https://markscanlon.co/publications/EMAttacksComputerMonitors.html) (2018). DOI: https://doi.org/10.1145/3230833.3234690. PDF: https://markscanlon.co/publications/EMAttacksComputerMonitors.pdf
- [Electromagnetic Side-Channel Attacks: Potential for Progressing Hindered Digital Forensic Analysis](https://markscanlon.co/publications/EMSideChannelsForForensics.html) (2018). DOI: https://doi.org/10.1145/3236454.3236512. PDF: https://markscanlon.co/publications/EMSideChannelsForForensics.pdf
- [Digital Forensic Investigation of Two-Way Radio Communication Equipment and Services](https://markscanlon.co/publications/TwoWayRadioForensics.html) (2018). DOI: https://doi.org/10.1016/j.diin.2018.04.007. PDF: https://markscanlon.co/publications/TwoWayRadioForensics.pdf
- [Digital Forensic Investigation of Two-Way Radio Communication Equipment and Services](https://markscanlon.co/publications/RadioTraces.html) (2018). PDF: https://markscanlon.co/publications/RadioTraces.pdf
- [Deep Learning at the Shallow End: Malware Classification for Non-Domain Experts](https://markscanlon.co/publications/DeepLearningMalware.html) (2018). DOI: https://doi.org/10.1016/j.diin.2018.04.024. PDF: https://markscanlon.co/publications/DeepLearningMalware.pdf
- [Evaluating Automated Facial Age Estimation Techniques for Digital Forensics](https://markscanlon.co/publications/EvaluatingFacialAgeEstimation.html) (2018). DOI: https://doi.org/10.1109/SPW.2018.00028. PDF: https://markscanlon.co/publications/EvaluatingFacialAgeEstimation.pdf
- [Hierarchical Bloom Filter Trees for Approximate Matching](https://markscanlon.co/publications/HierarchicalBloomFilterTrees.html) (2018). DOI: https://doi.org/10.15394/jdfsl.2018.1489. PDF: https://markscanlon.co/publications/HierarchicalBloomFilterTrees.pdf
- [Private Web Browser Forensics: A Case Study on Epic Privacy Browser](https://markscanlon.co/publications/PrivateWebBrowserForensics.html) (2018). PDF: https://markscanlon.co/publications/PrivateWebBrowserForensics.pdf
- [Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees](https://markscanlon.co/publications/MRSHv2BloomFilterTrees.html) (2018). DOI: https://doi.org/10.1007/978-3-319-73697-6_11. PDF: https://markscanlon.co/publications/MRSHv2BloomFilterTrees.pdf
- [Data Analytics for Digital Forensics and Cybersecurity](https://markscanlon.co/publications/DataAnalyticsForDigitalForensicsAndCybersecurity.html) (2017). PDF: https://markscanlon.co/publications/DataAnalyticsForDigitalForensicsAndCybersecurity.pdf
- [Privileged Data within Digital Evidence](https://markscanlon.co/publications/PrivilegedDataWithinDigitalEvidence.html) (2017). DOI: https://doi.org/10.1109/Trustcom/BigDataSE/ICESS.2017.307. PDF: https://markscanlon.co/publications/PrivilegedDataWithinDigitalEvidence.pdf
- [Integration of Ether Unpacker into Ragpicker for plugin-based Malware Analysis and Identification](https://markscanlon.co/publications/EtherUnpacker.html) (2017). PDF: https://markscanlon.co/publications/EtherUnpacker.pdf
- [Forensic Analysis of Epic Privacy Browser on Windows Operating Systems](https://markscanlon.co/publications/EpicPrivacyBrowser.html) (2017). PDF: https://markscanlon.co/publications/EpicPrivacyBrowser.pdf
- [Evaluation of Digital Forensic Process Models with Respect to Digital Forensics as a Service](https://markscanlon.co/publications/ProcessModelsDFaaS.html) (2017). PDF: https://markscanlon.co/publications/ProcessModelsDFaaS.pdf
- [EviPlant: An Efficient Digital Forensic Challenge Creation, Manipulation, and Distribution Solution](https://markscanlon.co/publications/EviPlant.html) (2017). DOI: https://doi.org/10.1016/j.diin.2017.01.010. PDF: https://markscanlon.co/publications/EviPlant.pdf
- [Behavioral Service Graphs: A Formal Data-Driven Approach for Prompt Investigation of Enterprise and Internet-wide Infections](https://markscanlon.co/publications/BehavioralServiceGraphsFormal.html) (2017). DOI: https://doi.org/10.1016/j.diin.2017.02.002. PDF: https://markscanlon.co/publications/BehavioralServiceGraphsFormal.pdf
- [Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit](https://markscanlon.co/publications/TowardsDataDeduplication.html) (2016). DOI: https://doi.org/10.1109/NTMS.2016.7792486. PDF: https://markscanlon.co/publications/TowardsDataDeduplication.pdf
- [Behavioral Service Graphs: A Big Data Approach for Prompt Investigation of Internet-wide Infections](https://markscanlon.co/publications/BehavioralServiceGraphs.html) (2016). DOI: https://doi.org/10.1109/NTMS.2016.7792437. PDF: https://markscanlon.co/publications/BehavioralServiceGraphs.pdf
- [IPv6 Security and Forensics](https://markscanlon.co/publications/IPv6SecurityAndForensics.html) (2016). DOI: https://doi.org/10.1109/INTECH.2016.7845143. PDF: https://markscanlon.co/publications/IPv6SecurityAndForensics.pdf
- [Battling the Digital Forensic Backlog through Data Deduplication](https://markscanlon.co/publications/BattlingTheBacklogDataDeduplication.html) (2016). DOI: https://doi.org/10.1109/INTECH.2016.7845139. PDF: https://markscanlon.co/publications/BattlingTheBacklogDataDeduplication.pdf
- [Battling the Digital Forensic Backlog](https://markscanlon.co/publications/BattlingTheDigitalForensicBacklog.html) (2016)
- [An Analytical Approach to the Recovery of Data From 3rd Party Proprietary CCTV File Systems](https://markscanlon.co/publications/AnalyticalApproachToTheRecoveryOfDataFromCCTVFileSystems.html) (2016). DOI: https://doi.org/10.13140/RG.2.2.31446.65601. PDF: https://markscanlon.co/publications/AnalyticalApproachToTheRecoveryOfDataFromCCTVFileSystems.pdf
- [Current Challenges and Future Research Areas for Digital Forensic Investigation](https://markscanlon.co/publications/CurrentChallengesAndFutureResearchAreas.html) (2016). DOI: https://doi.org/10.13140/RG.2.2.34898.76489. PDF: https://markscanlon.co/publications/CurrentChallengesAndFutureResearchAreas.pdf
- [On the Benefits of Information Retrieval and Information Extraction Techniques Applied to Digital Forensics](https://markscanlon.co/publications/OnTheBenefitsOfInformationRetrievalToDigitalForensics.html) (2016). DOI: https://doi.org/10.1007/978-981-10-1536-6_83. PDF: https://markscanlon.co/publications/OnTheBenefitsOfInformationRetrievalToDigitalForensics.pdf
- [Increasing Digital Investigator Availability through Efficient Workflow Management and Automation](https://markscanlon.co/publications/IncreasingDigitalInvestigatorAvailability.html) (2016). DOI: https://doi.org/10.1109/ISDFS.2016.7473525. PDF: https://markscanlon.co/publications/IncreasingDigitalInvestigatorAvailability.pdf
- [Tiered Forensic Methodology Model for Digital Field Triage by Non-Digital Evidence Specialists](https://markscanlon.co/publications/TieredForensicMethodologyModelForDigitalFieldTriage.html) (2016). DOI: https://doi.org/10.1016/j.diin.2016.01.010. PDF: https://markscanlon.co/publications/TieredForensicMethodologyModelForDigitalFieldTriage.pdf
- [An Evaluation of Google Plus Communities as an Active Learning Journal Alternative to Improve Learning Efficacy](https://markscanlon.co/publications/GooglePlusCommunities-ActiveLearningJournalAlternative.html) (2015). PDF: https://markscanlon.co/publications/GooglePlusCommunities-ActiveLearningJournalAlternative.pdf
- [Network Investigation Methodology for BitTorrent Sync: A Peer-to-Peer Based File Synchronisation Service](https://markscanlon.co/publications/NetworkInvestigationMethodologyForBitTorrentSync.html) (2015). DOI: https://doi.org/10.1016/j.cose.2015.05.003. PDF: https://markscanlon.co/publications/NetworkInvestigationMethodologyForBitTorrentSync.pdf
- [Forensic Analysis and Remote Evidence Recovery from Syncthing: An Open Source Decentralised File Synchronisation Utility](https://markscanlon.co/publications/ForensicAnalysisAndRemoteEvidenceRecoveryFromSyncthing.html) (2015). DOI: https://doi.org/10.1007/978-3-319-25512-5_7. PDF: https://markscanlon.co/publications/ForensicAnalysisAndRemoteEvidenceRecoveryFromSyncthing.pdf
- [Project Maelstrom: Forensic Analysis of the BitTorrent-Powered Browser](https://markscanlon.co/publications/ProjectMaelstrom.html) (2015). DOI: https://doi.org/10.15394/jdfsl.2015.1216. PDF: https://markscanlon.co/publications/ProjectMaelstrom.pdf
- [Towards the Forensic Identification and Investigation of Cloud Hosted Servers through Noninvasive Wiretaps](https://markscanlon.co/publications/TowardsTheForensicIdentificationAndInvestigationOfCloudHostedServers.html) (2015). DOI: https://doi.org/10.1109/ARES.2015.77. PDF: https://markscanlon.co/publications/TowardsTheForensicIdentificationAndInvestigationOfCloudHostedServers.pdf
- [Remote Evidence Acquisition](https://markscanlon.co/publications/RemoteEvidenceAcquisition.html) (2015)
- [Overview of the Forensic Investigation of Cloud Services](https://markscanlon.co/publications/OverviewOfTheForensicInvestigationOfCloudServices.html) (2015). DOI: https://doi.org/10.1109/ARES.2015.81. PDF: https://markscanlon.co/publications/OverviewOfTheForensicInvestigationOfCloudServices.pdf
- [HTML5 Zero Configuration Covert Channels: Security Risks and Challenges](https://markscanlon.co/publications/HTML5ZeroConfigurationCovertChannels.html) (2015). PDF: https://markscanlon.co/publications/HTML5ZeroConfigurationCovertChannels.pdf
- [Leveraging Decentralisation to Extend the Digital Evidence Acquisition Window: Case Study on BitTorrent Sync](https://markscanlon.co/publications/LeveragingDecentralisationToExtendTheDigitalEvidenceAcquisitionWindow.html) (2014). DOI: https://doi.org/10.15394/jdfsl.2014.1173. PDF: https://markscanlon.co/publications/LeveragingDecentralisationToExtendTheDigitalEvidenceAcquisitionWindow.pdf
- [BitTorrent Sync: Network Investigation Methodology](https://markscanlon.co/publications/BitTorrentSyncNetworkInvestigationMethodology.html) (2014). DOI: https://doi.org/10.1109/ARES.2014.11. PDF: https://markscanlon.co/publications/BitTorrentSyncNetworkInvestigationMethodology.pdf
- [An analysis of BitTorrent cross-swarm peer participation and geolocational distribution](https://markscanlon.co/publications/AnAnalysisOfBitTorrentCrossSwarmPeerParticipation.html) (2014). DOI: https://doi.org/10.1109/ICCCN.2014.6911846. PDF: https://markscanlon.co/publications/AnAnalysisOfBitTorrentCrossSwarmPeerParticipation.pdf
- [Digital Evidence Bag Selection for P2P Network Investigation](https://markscanlon.co/publications/DigitalEvidenceBagSelectionForP2PNetworkInvestigation.html) (2014). DOI: https://doi.org/10.1007/978-3-642-40861-8_44. PDF: https://markscanlon.co/publications/DigitalEvidenceBagSelectionForP2PNetworkInvestigation.pdf
- [The Case for a Collaborative Universal Peer-to-Peer Botnet Investigation Framework](https://markscanlon.co/publications/TheCaseForACollaborativeUniversalP2PBotnetInvestigationFramework.html) (2014). PDF: https://markscanlon.co/publications/TheCaseForACollaborativeUniversalP2PBotnetInvestigationFramework.pdf
- [BitTorrent Sync: First Impressions and Digital Forensic Implications](https://markscanlon.co/publications/BitTorrentSyncFirstImpressionsAndDigitalForensicImplications.html) (2014). DOI: https://doi.org/10.1016/j.diin.2014.03.010. PDF: https://markscanlon.co/publications/BitTorrentSyncFirstImpressionsAndDigitalForensicImplications.pdf
- [Study of Peer-to-Peer Network Based Cybercrime Investigation: Application on Botnet Technologies](https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.html) (2013). PDF: https://markscanlon.co/publications/StudyOfPeer-to-PeerNetworkBasedCybercrimeInvestigation.pdf
- [Universal Peer-to-Peer Network Investigation Framework](https://markscanlon.co/publications/UniversalPeerToPeerNetworkInvestigationFramework.html) (2013). DOI: https://doi.org/10.1109/ARES.2013.91. PDF: https://markscanlon.co/publications/UniversalPeerToPeerNetworkInvestigationFramework.pdf
- [Investigating Cybercrimes That Occur on Documented P2P Networks](https://markscanlon.co/publications/InvestigatingCybercrimesThatOccurOnDocumentedP2PNetworks2013.html) (2013). DOI: https://doi.org/10.4018/978-1-4666-2041-4.ch010. PDF: https://markscanlon.co/publications/InvestigatingCybercrimesThatOccurOnDocumentedP2PNetworks2013.pdf
- [Peer-to-Peer Botnet Investigation: A Review](https://markscanlon.co/publications/P2PBotnetInvestigationAReview.html) (2012). DOI: https://doi.org/10.1007/978-94-007-5064-7_33. PDF: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.pdf
- [Investigating Cybercrimes That Occur on Documented P2P Networks](https://markscanlon.co/publications/InvestigatingCybercrimesThatOccurOnDocumentedP2PNetworks.html) (2011). DOI: https://doi.org/10.4018/jaci.2011040104. PDF: https://markscanlon.co/publications/InvestigatingCybercrimesThatOccurOnDocumentedP2PNetworks.pdf
- [A week in the Life of the Most Popular BitTorrent Swarms](https://markscanlon.co/publications/AWeekInTheLifeOfTheMostPopularBitTorrentSwarms.html) (2010). PDF: https://markscanlon.co/publications/AWeekInTheLifeOfTheMostPopularBitTorrentSwarms.pdf
- [Online Acquisition of Digital Forensic Evidence](https://markscanlon.co/publications/OnlineAcquisitionOfDigitalForensicEvidence.html) (2009). DOI: https://doi.org/10.1007/978-3-642-11534-9_12. PDF: https://markscanlon.co/publications/OnlineAcquisitionOfDigitalForensicEvidence.pdf
- [Enabling the Remote Acquisition of Digital Forensic Evidence through Secure Data Transmission and Verification](https://markscanlon.co/publications/EnablingRemoteEvidenceAcquisition.html) (2009). PDF: https://markscanlon.co/publications/EnablingRemoteEvidenceAcquisition.pdf