Sunday, July 14, 2019
Columbia Falls Ballroom Foyer Workshop 1 Workshop 2
12:00 to 17:30

Registration Opens

Pick up your badge, t-shirt, and proceedings.

13:00 to 15:00

Introducing a New Method for Chip-Off Success: Vapor Phase Workshop

Steve Watson (VTO Labs) David Rathbone

KAPE:  What’s all the buzz about? Workshop

Mark Hallman (SANS Institute)
15:00 to 15:15

Break

Refreshments in the Foyer

15:15 to 17:15

Behind the scenes of memory extraction Workshop

Joe FitzPatrick

Introduction to Ghidra Malware Analysis Workshop

Erika Noerenberg (Carbon Black)
Monday, July 15, 2019
Columbia Falls Ballroom Foyer Workshop 1 Workshop 2
8:00 to 8:45

Registration

Pick up your badge, t-shirt, and proceedings.

8:45 to 9:00

Opening Remarks

9:00 to 10:15
10:15 to 10:30

Break

Refreshments in the Foyer

10:30 to 11:30

Session I: Memory Forensics

Chair: 
Andrew White (Dell Secureworks)

Windows Memory Forensics: Detecting (un)intentionally hidden injected Code by examining Page Table Entries Paper

Frank Block Andreas Dewald

Inception: Virtual Space in Memory Space in Real Space -- Memory Forensics of Immersive Virtual Reality with the HTC Vive Paper

Peter Casey Rebecca Lindsay-Decusati Ibrahim Baggili (University of New Haven) Frank Breitinger (University of New Haven)
11:30 to 12:50

Lunch with Birds of a Feather

Lunch is included in the registration fee and will be served on-site.

Lunch will be in Willamette Falls / University Grill Lounge & Restaurant.

** Current BoF Lunch Topics ***

Access & Accessibility

Evidence Interoperability (CASE/AFF4)

Forensic intrusion analysis

IoT Hardware Acquisition & Analysis

Locked device exploitation

Reverse Engineering

Volatile memory Analysis

 

12:50 to 13:00

Works in Progress

Share a new idea or project in 5 minutes or less!  Sign up on site.

13:00 to 15:00

Session II: Files and Filesystem Forensics

Chair: 
Alex Nelson, Ph.D. (NIST)

Syntactical File Carving and Automated Generation of Reproducible Datasets Paper

Jan-Niclas Hilgert Martin Lambertz Mariia Rybalka Roman Schell

bring2lite: a structural Concept and Tool for Forensic Data Analysis and Recovery of Deleted SQLite Records Paper

Christian Meng Harald Baier (University of Applied Sciences, Darmstadt)

DB3F & DF-Toolkit: The Database Forensic File Format and the Database Forensic Toolkit Paper

James Wagner (DePaul University) Alexander Rasin (DePaul University) Karen Heart Rebecca Jacob Jonathan Grier (Grier Forensics)

Using NTFS Cluster Allocation Behavior to Find the Location of User Data Paper

Martin Karresand Stefan Axelsson (Norwegian University of Science and Technology) Geir Olav Dyrkolbotn (NTNU)
15:00 to 15:30

Break

Refreshments in the Foyer

15:30 to 17:00

Presentations: Access & Accessibility

Chair: 
Jessica Hyde (George Mason University / Magnet Forensics )

Extreme Damaged Devices Presentation

Steve Watson (VTO Labs)

Forensic Jailbreaking of iOS devices Presentation

Bradley Schatz, Ph.D. (Schatz Forensic)

Introducing Digital Forensics Science in a Virtual Learning Environment Presentation

Eoghan Casey, Ph.D. (University of Lausanne) Daryl Pfeif (Digital Forensics Solutions and DFRWS) Cassy Soden

CASE the Cyber-investigation Analysis Standard Expression Presentation

Vik Harichandran Cory Hall (MITRE) Andrew Sovern Deborah Nichols Navaneeth Subramanian Trevor Bobka
17:45 to 18:15

Board the Buses

There are buses to the Welcome Reception.  The first one starts loading at 5:45 and will leave at 6 or when full.  The last bus will leave at 6:15.  The Portland Spirit Dock is 0.8 miles from the hotel if you would prefer to walk. 

18:30 to 19:00

Boarding Portland Spirit

SW Salmon Springs Dock in downtown Portland. Don't miss the boat!

19:00 to 21:30

Reception

Join us for a 2.5 hour evening welcome reception, river cruise and dinner.

The cruise includes Pacific NW cuisine prepared fresh on board and a full service (cash) bar.

IF YOU HAVE ANY DIETARY RESTRICTIONS PLEASE UPDATE YOUR REGISTRATION ASAP

Tuesday, July 16, 2019
Columbia Falls Ballroom Foyer Workshop 1 Workshop 2
8:00 to 8:55

Registration

Pick up your badge, t-shirt, and proceedings.

8:55 to 9:00

Opening Remarks

9:00 to 10:15
10:15 to 10:30

Break

Refreshments in the Foyer

10:30 to 12:00

Presentations: Artefacts & Interpretation

Chair: 
Erika Noerenberg (Carbon Black)

Android Auto & Google Assistant – How Google Encourages Hands-Free Motoring Presentation

Joshua Hickman

Old Filesystems in New IoT Devices Presentation

Steve Watson (VTO Labs)

An Incomplete Tour of the Forensic Implications of the Windows 10 Activity Timeline Presentation

Vico Marziale, Ph.D. (BlackBag Technologies)

Memory forensics as Triage Analysis Presentation

Aaron Sparling
12:00 to 13:20

Lunch and Posters

Lunch is included in the registration fee.  Posters and Demos will occur at the same time.

Lunch is located in Willamette Falls / University Grill Lounge & Restaurant.

13:20 to 13:30

Works in Progress

Share a new idea or project in 5 minutes or less!  Sign up on site.

13:30 to 15:30

Session III: IoT Forensics

Chair: 
Frank Adelstein, Ph.D. (NFA Digital)

Forensic analysis of the Nintendo 3DS NAND Paper

Gus Pessolano Huw Read Iain Sutherland Konstantinos Xynos

Forensic analysis of water damaged mobile devices Paper

Aya Fukami Kazuhiro Nishimura

Digital Forensic Practices and Methodologies for AI Speaker Ecosystems Paper

Wooyeon Jo Yeonghun Shin Hyungchan Kim Dongkyun Yoo Donghyun Kim (KITRI BoB) Cheulhoon Kang Jongmin Jin Junghoon Oh Bitna Na Taeshik Shon

Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices Paper

Asanka Sayakkara Nhien An Le Khac (University College Dublin) Mark Scanlon, Ph.D. (University College Dublin)
15:30 to 15:50

Break

Refreshments in the Foyer

15:50 to 16:00

Awards

Join us for the announcement of the Best Paper Award

16:00 to 17:10
17:10 to 17:30

DFRWS Forensic Challenge Presentation

The winners of the 2019 Forensic Challenge will present their submission.

18:00 to 19:30

Banquet

The Banquet will be held on-site in the Willamette Falls / University Grill Lounge & Restaurant.  Join us for dinner and camaraderie.

19:30 to 22:00

Forensics Rodeo

The DFRWS Rodeo is a team based event where participants group together to solve forensically themed challenges in order to score points. The Rodeo is open to all attendees of the conference, regardless of ability level, and is designed to be a lighthearted social event where participants can meet new people and learn new skills. Stick around after the banquet to participate and try to win some prizes! To learn more about the rodeo, try out previous challenges or read challenge write-ups, go to https://dfrws.rodeo.

Wednesday, July 17, 2019
Columbia Falls Ballroom Foyer Workshop 1 Workshop 2
9:00 to 9:25

Registration

Pick up your badge, t-shirt, and proceedings.

9:25 to 9:30

Opening Remarks

9:30 to 11:30

Session IV: Special Topics in Forensics

Chair: 
Wietse Venema, Ph.D. (Google)

HookTracer: A System for Automated and Accessible API Hooks Analysis Paper

Golden Richard III, Ph.D. (Louisiana State University) Andrew Case (Volexity) Aisha Ali-Gombe Mingxuan Sun Ryan Maggio Md Firoz-Ul-Amin Mohammad Jalalzai

FbHash: A New Similarity Hashing Scheme for Digital Forensics Paper

Donghoon Chang Mohona Ghosh Somitra Sanadhya Monika Singh Douglas White (NIST)

A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) Paper

Laura Sanchez Cinthya Grajeda Mendez Ibrahim Baggili (University of New Haven) Cory Hall (MITRE)

AFF4-L: A scalable open logical evidence container Paper

Bradley Schatz, Ph.D. (Schatz Forensic)
11:30 to 11:50

Closing Remarks

11:50 to 13:00

Lunch on Wednesday

Lunch is included in the registration fee, please join us.

Lunch is located in Willamette Falls / University Grill Lounge & Restaurant.

13:00 to 17:00

Investigating LOLBins & Scripts Workshop

Alissa Torres
18:00 to 20:00

Wrap Party

@ Ground Kontrol

Ground Kontrol is the West Coast’s premier classic arcade celebrating video gaming’s “golden age” featuring over 100 classic video games and over 40 pinball machines.
Food and a full-service bar are available onsite. GAMES ARE ON US!

Add to My Calendar

iCal Feed

Please click the button to subscribe to the iCal feed for this Conference.