@article { dolangavitt2008winreg,
    author = "Brendan Dolan-Gavitt",
    title = "Forensic analysis of the Windows registry in memory",
    journal = "Digital Investigation",
    volume = 5,
    pages = S26--S32,
    year = 2008,
}