Authors: Gaurav Gogia
DFRWS APAC 2026
Abstract
Modern investigations require analysts to move beyond ad‑hoc scripts and vendor tooling toward reproducible, extensible forensic pipelines. While traditional workflows rely heavily on manual parsing or monolithic tools, investigators increasingly need the ability to model artifacts, inject custom logic, and compose lightweight tooling tailored to their cases.
This workshop introduces a language-agnostic methodology for building forensic tooling from first principles: modelling artifacts, normalizing heterogeneous timestamps, constructing timelines, and embedding custom logic for detection and reconstruction. Participants will implement these concepts using their preferred language (Python, Go, Rust), while the Mutant DSL is used as a convenience layer to demonstrate ergonomic patterns and under-the-hood mechanics. Mutant is optional and serves only as an illustrative example, similar in spirit to Nugget (DFRWS EU 2018), which showed how domain-specific languages can simplify forensic reasoning.
Biography
 Gaurav Gogia |