on the role of file system metadata in digital forensics .
A recursive session token protocol for use in computer forensics and TCP traceback