Leimich, Petra, Harrison, Josh, Buchanan, William J., "A RAM triage methodology for Hadoop HDFS forensics", Digital Investigation, 2016