Kripos New Building
Conference Location: 
National Criminal Investigation Service (KRIPOS)

According to the Norse sagas, Oslo was founded around 1049 by Harald Hardrada. Recent archaeological research, however, has uncovered Christian burials which can be dated to prior to AD 1000, evidence of a preceding urban settlement. This called for the celebration of Oslo's millennium in 2000. It has been regarded as the capital city of Norway since the reign of Haakon V of Norway (1299–1319), the first king to reside permanently in the city. Oslo occupies an arc of land at the northernmost end of the Oslofjord. The city is surrounded by green hills and mountains. There are 40 islands within the city limits.

DFRWS EU 2019 would like to extend a special thanks to Norwegian National Criminal Investigation Service, commonly known as KRIPOS. The generous support of KRIPOS as a Co-Organizer of the event has made it possible to bring the DFRWS conference to Oslo.

DFRWS EU 2019 will be held at the KRIPOS Headquarters at Bryn, Oslo. Kripos has several roles, of which the main ones are to be a national centre of expertise for the Norwegian police, point of contact for international police cooperation, data controller for national police databases, and a national police forensic laboratory. In addition Kripos has cyber crime investigation expertise and an advanced digital forensics lab. 

Kripos has been located at Bryn since the autumn 2000, at the location of an old farm close to the Alna river with a history dating from at least 1200 CE. The original name of the place (Bruvin) indicates that the place has been pastureland before the viking age. The farm was demolished in the 1950's and is now a mixed residential and industrial area, and is a public transportation hub with buses, a subway station (Brynseng) and a train station. 

In 2017, the construction of a new building next to the old Kripos building was finished, which included a modern conference centre. DFRWS EU 2019 is the first international academic conference held in this new conference centre.  

Some more information of the main roles can be found here: http://www.politiet.no/en/om/organisasjonen/sarorganene/kripos/key-roles-of-ncis/

Social events and lunches are included in the registration fee. However, accomodation is not included. Accomodation is the responsibility of DFRWS attendees. There are many nice hotels throughout Oslo to choose from.

A bulk reservation has been made at the hotel nearest to the conference venue, Scandic Helsfyr Hotel, for information contact Hilde Melheim Hilde.Melheim@scandichotels.com and bookings should be make using the booking code BKRI230419.

As an alternative, hotel rooms may be booked at Smarthotel. Contact person: Kim Kallåk-Ertsås, ke@smarthotel.no. Smarthotel (https://www.smarthotels.no/oslo) can offer affordable rooms in the city centre, in walking distance (500 m) to the Metro station "Nationaltheateret". Eastbound Metro lines 1, 2, 3 and 4 go to "Brynseng" station, close to the conference venue. The price is NOK 820 for single room, and NOK 1020 for double room. The rooms are reserved at this rate until March 9, 2019, For this option send email to post.oslo@smarthotel.no, or call at +47 415 36 500. Please state the order number "205869" for booking. The hotel will need a payment card number at booking time, and payment at check in time.


Public transport information:

For information on public transport including buses, trams, metro lines, and ferries including ticketing and timetables, please see this document.

We've also prepared a useful local information document.


Forensic Rodeo

The DFRWS Forensic Rodeo is a friendly, but fierce, capture-the-flag style forensics competition held during and after the conference dinner at the DFRWS EU conference. Attendees can participate in teams. This page explains the context and the challenges of the 2019 rodeo: https://www.cs1.tf.fau.de/dfrws-eu-2019-forensic-rodeo/


Wrap Party Address:

Karl Johans Gate 37,
0162 Oslo



Keynote #1: Where Are We Headed? Considerations for Digital Forensics of Emerging Technologies

Steve Watson

VTO Labs

Steve Watson is a technologist focused in the areas of data recovery, forensics, risk and compliance. His career spans two decades and a variety of technology environments from start-ups to Fortune 50 companies. He is the Chief Executive Officer of the ground-breaking technology startup, VTO Labs.

Watson is the Principal Investigator for two U.S. government scientific programs focused on digital forensics. His research in the area of data recovery and digital forensics is focused on new and emerging technologies and extremely damaged devices. Watson’s expertise lies in getting data off of electronic devices that are challenging for others - damaged devices, old devices, new devices and unsupported devices. He brings a full research portfolio that has assisted his corporate, government and law enforcement connections around the world.

He is a member of the Digital Evidence subcommittee of the NIST, Organization of Scientific Area Committees, where he serves as the Task Group Chair for mobile device forensics. He also serves as the Chair of the Forensics Committee on the Scientific Working Group on Digital Evidence (SWGDE) representing expertise in mobile devices, emerging technologies and damaged devices. Watson is also the founder of the recently announced International Consortium on Digital Forensics for the Internet of Things.

Keynote #2: How Do We Handle Ridiculously Large Criminal Cases With Hundreds Of Millions Of Possible Evidence Documents?

Thomas Walmann


Thomas Walmann has a background as an experimental physicist with a PhD in statistical physics. After finishing his PhD, he undertook cross-disciplinary research in the oil and gas industry, geology, biophysics, aluminum processing, as well as other fields in academia for 10 years. About 15 years ago, he joined the Norwegian police as head of digital forensics and ICT operations at ØKOKRIM - the economic and environmental crime agency in Norway. There he has participated in most operations and development of the evidence handling infrastructure for large criminal cases – the ridiculously large cases - with more than 100 million real documents.


DFRWS invites contributions in five categories

  • Research papers
  • Practitioner / industry researcher presentations
  • Hands-on workshops / tutorials
  • Panel discussions
  • Demos and posters


RESEARCH PAPERS undergo double-blinded peer review, and the proceedings are published by Elsevier as a special issue of the Journal of Digital Investigation.

PRESENTATIONS, POSTERS, and DEMOS require a brief proposal, not a paper. These proposals undergo a light review process to select presentations of maximal interest to DFRWS attendees, and to filter out sales pitches. Presentation proposals must specify their target length from the following options: 20 minutes, 120 minutes (2 hours), 240 minutes (4 hours), or full day. Note, longer presentations and hands-on tutorials are referred to as ‘workshops’ described below.

WORKSHOPS / TUTORIALS can be several hours or full day, and typically include hands-on participation by attendees, allowing for an in-depth, detailed exploration of tools and techniques of interest to DFRWS attendees. Workshops can cover state-of-the-art research projects, useful tips and techniques for standard tools, or most anything that DFRWS attendees would consider beneficial. While commercial tools can be used, these workshops or tutorials should NOT be thinly-veiled commercial advertisements.

PANEL PROPOSALS: These should be one to three pages and clearly describe the topic, its relevance, and a list of potential panelists and their biographies. Panels will be evaluated based on the topic relevance and diversity of the panelists.

DFRWS will provide one free conference registration for each accepted workshop / tutorial.


Topics of Interest

DFRWS welcomes new perspectives that push the envelope of what is currently possible in digital forensics. Potential topics to be addressed by submissions include, but are not limited to:

  • Machine learning and data mining for digital evidence extraction/query
  • Social networking analysis and OSINT (Open Source Intelligence)
  • Malware and targeted attacks (analysis and attribution)
  • Forensics analysis and visualization of Big Data
  • Non-traditional forensic scenarios / contexts
  • Network and distributed system forensics
  • Mobile and embedded device forensics
  • Cloud and virtualized environments
  • Vehicle forensics (e.g., drones, cars)
  • SCADA / industrial control systems
  • Covert channels (e.g. TOR, VPN)
  • Implanted medical devices
  • Smart power grids
  • Smart buildings
  • Virtual currency
  • Digital forensic preparedness / readiness
  • Digital investigation case management
  • Digital evidence sharing and exchange
  • Digital forensic triage / survey
  • Digital forensic tool validation
  • Event reconstruction methods and tools
  • Digital evidence and the law
  • Case studies and trend reports
  • Anti-forensics and anti-anti-forensics
Submission Information

Submission criteria and templates are provided here: Proposal Requirements & Submission Instructions

All research paper and practitioner presentation submissions must be submitted through the EasyChair site at https://easychair.org/conferences/?conf=dfrwseu2019. Submissions must be in Adobe Acrobat PDF format.

Tutorial/workshop proposals must be emailed to eu-workshops <at> dfrws <dot> org in PDF or plain text format.

Panel proposals must be emailed to eu-panels <at> dfrws <dot> org in PDF or plain text format.


Student Scholarship and Award Program

DFRWS continues its outreach to students studying digital forensics. DFRWS and its sponsors will award one or more Student Travel Scholarships each year to students who present their accepted research papers. One scholarship will be awarded to the Best Student Research Paper awardee. More travel scholarships may be awarded, depending on sponsorship funding each year. Exact award amounts will vary, but are estimated to be between $1,000-$1,500 per award. Students must register (and pay the registration fee) for the conference and cover all travel expenses. The travel scholarships will be dispersed at the conference to reimburse student travel costs. DFRWS will notify the recipient of the Best Student Research Paper award on or before the conference registration deadline. Other awards (e.g. industry sponsored awards for research in specific topic areas) may be awarded after the registration deadline and are fully contingent on scholarship sponsorship by industry each year. Refer to the website for further details regarding eligibility, funding and selection (Student Scholarship & Award Program).

Contact Information

Additional information about DFRWS EU 2019 is available on website: https://dfrws.org/conferences/dfrws-eu-2019

For questions related to paper, presentation, and demo submissions, please send email to: eu-papers <at> dfrws <dot> org

For questions about workshop/tutorial proposals, please send email to: eu-workshops <at> dfrws <dot> org

For questions related to the organisation of DFRWS-EU 2019 please send email to: eu <at> dfrws <dot> org


Workshop / Tutorials Proposals Submission Deadline October 31, 2018
Papers / Presentations / Panel Proposals Submission Deadline November 4, 2018
Demo / Poster Proposals Submission Deadline January 21, 2019
Camera Ready Paper Submission and Presenter Registration January 23, 2019


Organizing Committee

Conference Co-Chair: Katrin Franke (Norwegian University of Technology and Science)
Conference Co-Chair: Bruce Nikkel, Ph.D. (Bern University of Applied Sciences)
Program Co-Chair: Holger Morgenstern (Albstadt-Sigmaringen University)
Program Co-Chair: Mark Scanlon, Ph.D. (University College Dublin)
Chief Organizational Officer: Daryl Pfeif (Digital Forensics Solutions and DFRWS)
Local Arrangements Co-Chair: Steffen Thorkildsen
Local Arrangements Co-Chair: Marina Shalaginova
Keynote Chair: Craig Valli
Workshop Chair: Ali Dehghantanha (University of Guelph)
Workshop Chair: John Sheppard (Waterford Institute of Technology)
Rodeo Chair: Felix Freiling (Friedrich-Alexander-University)
Rodeo Chair: Mattia Epifani (ITTIG - CNR)
Forensic Challenge Chair: Eoghan Casey, Ph.D. (University of Lausanne)
Poster Chair: Jens-Petter Sandvik (Norwegian University of Technology and Science)
Proceedings Chair: Babak Habibnia (University College Dublin)
Web Chair: Mark Scanlon, Ph.D. (University College Dublin)
Outreach and Social Media Chair: Scar de Courcier (Forensic Focus)
Sponsorship Chair: David-Olivier Jaquet-Chiffelle (University of Lausanne)

Technical Program Committee

Frank Adelstein, Ph.D. (NFA Digital)
Abhijit Ambekar
Olga Angelopoulou (University of Hertfordshire)
Cosimo Anglano (Universitá del Piemonte Orientale)
Harald Baier (University of Applied Sciences, Darmstadt)
Nicole Beebe, Ph.D. (UTSA)
Emmanuel Benoist
David Billard (University of Applied Sciences in Geneva)
Elias Bou-Harb (National Cyber Forensics and Training Alliance / Concordia University )
Owen Brady (King's College London)
Frank Breitinger (University of Liechtenstein)
Ahmad Raza Cheema (National University of Sciences and Technology)
Jack Cole
Patrick De Smet (NICC/INCC)
Mattia Epifani (ITTIG - CNR)
Katrin Franke (Norwegian University of Technology and Science)
Felix Freiling (Friedrich-Alexander-University)
Zeno Geradts (Netherlands Forensic Institute)
Pavel Gladyshev, Ph.D. (University College Dublin)
Oliver Goebel
Michael Gruhn (Friedrich-Alexander-Universität Erlangen-Nürnberg)
Detlef Guenther (Volkswagen AG)
Hans Henseler, Ph.D. (University of Applied Sciences Leiden)
Mario Hildebrandt (Universität Magdeburg)
Jan-Niclas Hilgert
Graeme Horsman
Joshua James (Digital Forensic Investigation Research Laboratory, Hallym University)
David-Olivier Jaquet-Chiffelle (University of Lausanne)
Christian Keil (DFN-CERT)
Stefan Kiltz (Universität Magdeburg)
Christian Kraetzer
Hanno Langweg (HTWG Konstanz)
Nhien An Le Khac (University College Dublin)
Timothy Leschke, Ph.D. (Johns Hopkins University)
David Lillis (University College Dublin)
Holger Morgenstern (Albstadt-Sigmaringen University)
Bruce Nikkel, Ph.D. (Bern University of Applied Sciences)
Gilbert Peterson (US Air Force Institute of Technology)
Gaston Pugliese
Christian Riess
Dror Rimon
Vassil Roussev, Ph.D. (University of New Orleans)
Mark Scanlon, Ph.D. (University College Dublin)
Bradley Schatz, Ph.D. (Schatz Forensic)
Tobias Scheible (Albstadt-Sigmaringen University)
Christina Thorpe (Institute of Technology Blanchardstown)
Thomas Schreck
Marko Schuba (FH Aachen)
Peter Sommer
Michael Spreitzenbarth (Siemens CERT)
Marian Svetlik (Risk Analysis Consultants)
Simon Tjoa
Wietse Venema, Ph.D. (Google)
Jeroen van den Bos (Netherlands Forensic Institute)
Tim Vidas, Ph.D. (Carnegie Mellon University)
Claus Vielhauer (FH Brandenburg)
Erwin van Eijk (Netherlands Forensic Institute)
Ronald van der Knijff


DFRWS EU Registration is Open!  Registration includes DFRWS Workshops, the Main Conference Event, Lunch, Refreshments, Social Events and the DFRWS Rodeo.

Type of RegistrationEarly BirdRegular RateOnsite Registration
Law Enforcement€450€500€550
Rates Valid UntilExpires 3rd of March4th March - April12thApril 13th-April 26th


Welcome Reception / Demo Session

Magnet Forensics is a global leader in digital investigative technology and was built on a foundation of helping and empowerment. We help investigative teams find more evidence and empower them to uncover the truth.

Our products are designed to leverage the latest technological innovations to help law enforcement, consultants, military, and private enterprise address these issues. We use AI, automation, advanced searching techniques, modern data visualization and more to help investigative teams find digital evidence and understand the story it is telling.

Welcome Reception / Demo Session

Our international team of experts combines the latest attack techniques on hardware and software to explore the strength of any product. With our foundation in hardware testing, we are uniquely positioned to evaluate security where hardware and software challenges meet. We specialize in the security of devices that operate in an untrusted or hostile context.

Used by organizations worldwide, the integrated modular platform of Inspector combines cutting edge side channel analysis (DPA) and fault injection testing. Custom designed hardware and software enable government institutions, defense organizations, security evaluation laboratories and chip manufacturers around the globe to perform time efficient, reproducible, cutting edge security research.

Demo Sponsor

Compelson, in the forensics field since 1996, will present their new generation tools. The all-in-one MOBILedit Forensic Express is capable of a wide range of deleted data recovery, advanced application data analysis, multiple-device concurrent extractions, beautiful reports and huge phone base support. Free on-demand application analysis will be introduced.

Also to be presented is the pioneering digital photo analysis tool, Camera Ballistics, that matches a photo to a camera or phone, like a bullet to a gun answering the question if a photo was taken by an analyzed device. The tool uses the latest research in mathematics and physics.

Media Sponsor

Forensic Focus is the web's leading digital forensics portal for computer forensics and eDiscovery professionals.  Founded in July 2002, the site quickly developed a reputation for encouraging open discussion and information sharing in support of best practice development within the digital forensics industry. Although perhaps best known for its busy forums, Forensic Focus also offers breaking industry news, a worldwide directory of computer forensics education courses, interviews with industry thought leaders, job vacancy listings, a growing articles section and a monthly email newsletter with over 16,000 subscribers. For those looking to expand their professional network, Forensic Focus runs LinkedIn's largest digital forensics group.

Workshop Sponsor

Oxygen Forensics was founded in 2000 as a PC-to-Mobile Communication software company. This experience has allowed our team of mobile device experts to become unmatched in understanding mobile device communication protocols. With this knowledge, we have built innovative techniques into our Oxygen Forensic® Detective allowing our users to access much more critical information than competing forensic analysis tools. We offer the most advanced forensic data examination tools for mobile and IoT devices, smartwatches, cloud services and drones.
Oxygen Forensic® products have been successfully used in more than 150 countries across the globe including the USA, UK, Germany, Austria, France, Netherlands, Italy, Norway, Finland, Australia, China, Singapore, Brazil, etc.

In Partnership with DFRWS

NTNU is a university with an international focus, with headquarters in Trondheim and campuses in Ålesund and Gjøvik. NTNU has a main profile in science and technology, a variety of programmes of professional study, and great academic breadth.

Welcome Reception / Demo Session

Evimetry is a system for accelerating workflow at the front end of forensic processes, encompassing acquisition, live analysis, triage, and remote forensics.

KRIPOS - In Partnership with DFRWS

Norway's National Criminal Investigation Service, The NCIS (Norwegian name: Kripos), was established in 1959. The NCIS received prosecution powers in 2005, has about 570 staff (2018), and reports to the National Police Directorate.

Student Scholarship

Facebook is pleased to sponsor scholarships for students to attend DFRWS.  Founded in 2004, Facebook's mission is to give people the power to build community and bring the world closer together. People use Facebook to stay connected with friends and family, to discover what's going on in the world, and to share and express what matters to them.

Google - Student Scholarship Sponsor

Google's mission is to organize the world's information and make it universally accessible and useful. Google is pleased to sponsor scholarships for students to attend DFRWS.

CCIS - Community Builder

Centre for Cyber and Information Security (NTNU CCIS) is a national centre for research, education and competence development within the area of cyber and information security. NTNU CCIS is a public-private partnership with 26 private and public partners from industry, academia, privacy, and security.

Workshop Sponsor

Whether in teaching, research or further education: The Department of Technology and Computer Science BFH-TI convinces with extraordinary successes.

Ars Forensica Project - In Partnership with DFRWS

The overall objective of Ars Forensica is to provide new knowledge that can significantly improve the prevention, preparedness, investigation and prosecution of incidents in ICT environments, without compromising privacy and the rule of law.

Our mission is to drive the industry of mobile forensics

MSAB was founded in 1984 and we have a vast experience in mobile technology. Together with pioneering law enforcement organizations we have helped create the mobile forensics industry and we are still committed to driving and leading it forward. Our task is to develop the best possible solutions for mobile forensics and our reason for being is to help our customers do their job for society.