Tuesday, March 24, 2020

10:00 to 15:00A special event co-located and in association with DFRWS:

Women in Forensic Computing Workshop. For more information and registration information, please check the workshop website here: https://www.cybercrime.fau.de/women-in-forensic-computing-2020/

Wednesday, March 25, 2020

 Workshop Room 1Workshop Room 2Workshop Room 3
9:30 to 11:00Insights from Waves: Gathering Forensically-useful Insights from IoT Devices with
Electromagnetic Side-Channel Analysis (Part I)


Presenters: Asanka Sayakkara, Nhien-An Le-Khac, Mark Scanlon (University College Dublin)
Making the CASE for Cyber-investigation Interoperability (Part I)

Presenters: Eoghan Casey, Harm van Beek, Jessica Hyde, Cory Hall, Vik Harichandran, Mattia Epifani, Ryan Griffith, Deborah L. Nichols
Detection and Extraction of Evidence related to Cryptocurrency Use (Part I)

Presenter: Nick Furneaux
11:00 to 11:15Break
11:15 to 12:30Insights from Waves: Gathering Forensically-useful Insights from IoT Devices with Electromagnetic Side-Channel Analysis (Part II)Making the CASE for Cyber-investigation Interoperability (Part II)Detection and Extraction of Evidence related to Cryptocurrency Use (Part II)
12:30 to 14:00Lunch
14:00 to 15:30Internet-of-Things Forensics (Part I)

Presenter: Steve Watson (VTO Labs)
Dynamic Instrumentation for forensic research using Frida (Part I)

Presenter: Or Begam (Cellebrite)
How to instantly put cutting edge technology to use - Efficient cooperation between academia and law enforcement using Griffeye Connect (Part I)

Presenters: Frida Landin, Fredrik Hultin, Andreas Eriksson, Gunnar Johansson, (Griffeye)
15:30 to 15:45Break
15:45 to 17:00Internet-of-Things Forensics (Part II)Dynamic Instrumentation for forensic research using Frida (Part II)How to instantly put cutting edge technology to use - Efficient cooperation between academia and law enforcement using Griffeye Connect (Part II)

Thursday, March 26, 2020

TimingsMain Conference Room
9:00 to 9:15Welcome Address
9:15 to 10:15Keynote Address
Digital Forensics Past, Present and Future.
A recap of digital forensics over the last 20 years, highlighting the rapid growth of digital forensics, the growth of data and the associated rapid challenges in digital forensics in an ever increasing digital world.
10:15 to 10:30Break (Networking and Posters)
10:30 to 12:00Session I - Digital Forensic Science
Chair: Hans Henseler
Towards Sound Forensic Arguments: Structured Argumentation Applied to Digital Forensics Practice
Virginia N. L. Franqueira and Graeme Horsman
An Argumentation-Based Reasoner to Assist Digital Investigation and Attribution of Cyber-Attacks
Erisa Karafili, Linna Wang and Emil Lupu
Structuring the Evaluation of Location-Related Mobile Device Evidence
Eoghan Casey, David-Olivier Jaquet-Chiffelle, Hannes Spichiger, Elénore Ryser and Thomas Souvignet
12:00 to 13:00Lunch
13:00 to 14:00Session II - Filesystem Forensics and Extended Abstract Short Presentations
Chair: Mark Scanlon
Forensic Analysis of the Resilient File System (ReFS) Version 3.4
Paul Prade, Tobias Groß and Andreas Dewald
Artifacts for detecting timestamp manipulation in NTFS and their reliability
David Palmbach and Frank Breitinger
14:00 to 14:30PNG Data Detector for DECA. Kingson Chinedu Odogwu, Pavel Gladyshev and Babak Habibnia.

Detecting Cyberbullying “Hotspots” on Twitter: A Predictive Analytics Approach. Shuyuan Mary Ho, Dayu Kao, Ming-Jung Chiu-Huang, Wenyi Li and Chung-Jui Lai.

Big Data Forensics: Hadoop 3.2.0 Reconstruction. Edward Harshany, Ryan Benton, David Bourrie and William Glisson.

EMvidence: A Framework for Digital Evidence Acquisition from IoT Devices through Electromagnetic Side-Channel Analysis. Asanka Sayakkara, Nhien An Le Khac and Mark Scanlon.

Tainted Digital Evidence and Privacy Protection in Blockchain-based Systems. David Billard.
14:30 to 15:00Break
15:00 to 16:30Session III - Artificial Intelligence Aided Investigation
Chair: Katrin Franke
DeepUAge: Improving Underage Age Estimation Accuracy to Aid CSEM Investigation
Felix Anda, Nhien An Le Khac and Mark Scanlon
Cutting through the Emissions: Feature Selection from Electromagnetic Side-Channel Data for Activity Detection
Asanka Sayakkara, Luis Miralles, Nhien An Le Khac and Mark Scanlon
Towards Open-Set Forensic Source Grouping on JPEG Header Information
Patrick Mullan, Christian Riess and Felix Freiling
16:30 to 16:45Break
16:45 to 17:45Panel Session: Accreditation Pathways
Chair: Eoghan Casey (University of Lausanne)

Participants:
Gillian Tully (Forensic Science Regulator)
Neil Cohen (Defence Science and Technology Laboratory)
Brian Collins (Digital Coordination Supervisor, Derbyshire Constabulary)

Friday, March 27, 2020

TimingsMain Conference Room
9:00 to 10:00Presentation Session I
Chair: Frank Adelstein
Forensics analysis of Apple Homepod
Mattia Epifani
Expressing evaluative conclusions in cases involving tampering of digital evidence
Timothy Bollé, Francesco Servida, Johann Polewczyk, Thomas Souvignet and Eoghan Casey
Enabling real-time Collaborative Network Forensics
Marko Jung
10:00 to 10:30Break (Networking and Posters)
10:30 to 12:00Session IV - Network Investigations
Chair: John Sheppard
A Scalable Platform for Enabling the Forensic Investigation of Exploited IoT Devices and their Generated Unsolicited Activities
Sadegh Torabi, Elias Bou-Harb, Chadi Assi and Mourad Debbabi
IoT Botnet Forensics: A Comprehensive Digital Forensic Case Study on Mirai Botnet Servers
Xiaolu Zhang, Oren Upton, Nicole Beebe and Kim-Kwang Raymond Choo
IP addresses in the context of digital evidence in the criminal and civil case law of the Slovak Republic
Pavol Sokol, Laura Rózenfeldová, Katarína Lučivjanská and Jakub Harašta
12:00 to 13:00Lunch
13:00 to 14:30Session V - Memory Forensics
Chair: Harald Baier
BMCLeech: Introducing Stealthy Memory Forensics to BMC
Tobias Latzo, Julian Brost and Felix Freiling
Tampering Digital Evidence is Hard: The Case of Main Memory Images
Janine Schneider, Julian Wolf and Felix Freiling
On Challenges in Verifying Trusted Executable Files in Memory Forensics
Daniel Uroz and Ricardo J. Rodríguez
14:30 to 15:00Break (Networking and Posters)
15:00 to 16:00Presentation Session II
Chair: Jessica Hyde
Relevance scoring and clustering of digital traces
Ameya Puranik
Automated Normalisation and correlation of mobile device extractions using CASE
Eoghan Casey, Quentin Rossy and Martina Reif
Digital Forensic Techniques for Preservation and Archiving
Neil Jefferies
16:00 to 17:00Panel Session
Chair: Katrin Franke
17:00 to 17:15Closing Comments
19:00 to 21:00Planning Session

Saturday, March 28, 2020

 Encryption Summit at Bletchley Park
9:00 to 17:00A field trip to Bletchley Park, once the top-secret home of the World War Two Codebreakers. There will be a chance to explore the history of codebreaking at Bletchley Park, and several presentations exploring modern issues around encrypted digital evidence. Transport provided.