DFRWS is the leading digital forensics research conference and the 10th annual conference was held from August 2 to 4, 2010 in Portland, Oregon. The conference was held at the University Place Hotel and Conference Center near Portland State University.  It featured keynote talks by Troy Larson and Wenke Lee as well as an invited talk by AAron Walters.  16 peer-reviewed papers were presented and 2 panels were featured. Panel 1 was on “Challenges In Corporate Forensics – Why Isn’t Bigger Better?” with Josh Cady, Barbara A. Frederiksen, Michelle Lentzner, Steve Mancini, Sarah Mocas, and Ed Sandoval. Panel 2 was on “Technical Aspects of Large Scale Investigations” with Simson Garfinkel, Vassil Roussev, Bradley Schatz, and Nathan Swenson.

Congratulations to James Okolica and Gilbert Peterson for winning the Best Paper Award for “Windows Operating System Agnostic Memory Analysis“. We would also like to congratulate Solal Jacob for winning the Forensics Challenge. Thanks to the organizing committee, program committee, and sponsors for helping to make the conference go so smoothly.

The DFRWS2010 Challenge Results Challenge offered a chance to perform forensic analysis of memory dumps from a Sony Ericsson mobile device. This challenge was designed to be accessible to a wide audience, combined accessible forensic analysis tasks with some harder problems. We were pleased that the submissions this year came from not just researchers and developers, but also practitioners in the community. Some aspects of the challenge could not be completed using existing tools and new techniques had to be developed. However, many of the questions could be answered without developing new approaches.

Solal Jacob was the winner with a 2 part submission.  The first was an analysis of data using open source tools with some specialized modules.  Technical document detailing data structures and low-level analysis required to develop modules.  The submission used the open source Digital Forensic Framework (DFF), available at www.digital-forensic.org, and provides some new modules specifically for parsing memory dumps of Sony Ericsson K800i devices. Some advanced DFF modules used to analyze the memory were not included in the submission (e.g., timeline and advanced hex edit modules) but these were not core to the memory reconstruction challenge.