DFRWS is the leading digital forensics research conference and the 9th annual conference was held from August 17 to 19, 2009 in Montreal, Canada. The conference was held at the Delta Centre-ville Hotel and was the week after Usenix Security.  15 peer-reviewer papers were presented as well keynotes by Zeno Geradts and Benoit Ganon.  Day 1 also featured a panel on “Technical Approaches to Large-Scale Digital Forensics” with Vassil Roussev, Golden Richard, Simson Garfinkel, and Michael Cohen.

Congratulations to Simson Garfinkel, Paul Farrell, Vassil Roussev and George Dinolt for winning the Best Paper Award for “Bringing Science to Digital Forensics with Standardized Forensic Corpora”. We would also like to congratulate Wouter van Dongen and Alain Van Hoof for winning the Forensics Challenge. Thanks to the organizing committee, program committee, and sponsors for helping to make the conference go so smoothly.

The DFRWS 2009 Challenge focused on the development of tools and techniques for analyzing Playstation 3’s (PS3s). The Playstation 3 is a powerful, Cell processor-based system that can run both its native OS (which has significant DRM features that also thwart forensic investigation) and modern versions of Linux. This challenge focused on the Linux and network aspects of PS3s, and did not touch the DRM protected data. The challenge scenario required analysis of a physical memory dump, filesystem images, and network traces involving 2 PS3’s and a Playstation Portable (PSP).

The winners of the challenge were Wouter van Dongen and Alain van Hoof at University of Amsterdam System.  Their submission provided a thorough analysis of the file system and network traffic, with some information extracted from the physical memory dump. The careful correlation of information from multiple data sources was a major strength of this submission. The results were presented in a very clear manner, and there is a particularly impressive timeline diagram.