The Astor Crowne Plaza Hotel in the French Quarter of New Orleans, Louisiana was home to the fifth annual DFRWS on August 17-19, 2005. The workshop focused on digital evidence (DE) concealment and analysis techniques, DE scalability and automation, digital forensic tools and, DE legal issues.

The Best Paper Award went to “Data Hiding in Journaling File Systems” by Knut Eckstein (NC3A) and Marko Jahnke (FGAN/FKIE).

MEMORY ANALYSIS was one of the primary themes of DFRWS 2005. In an effort to motivate discourse, research and tool development in this area, the Organizing Committee created the intrusion/intellectual property theft scenario detailed below. This memory challenge was open to all, and team efforts were encouraged. An award was given to the people who extracted the most information from the memory dumps, and the quality of documentation and novelty of techniques were considered when choosing the winners. Network traffic associated with this intrusion was made available during the workshop.

Chris Betz: Developed memparser to reconstruct process list and extract information from process memory.
George M. Garner Jr. & Robert-Jan Mora: Developed kntlist to interpret structures in memory and maintain an audit log and integrity checks.