EU 2025 Program

Jump to: Mon – Tue – Wed – Thu  – Fri – Accepted Workshops – Accepted Posters –  Accepted Papers

Please note: This is the preliminary program, which is subject to change.

Time	Event	Location	Description
08:00-09:00	Registration
09:00-10:45	Workshop 1	D206	Creating holistic dataset for digital forensics with ForTrace++ (Hybrid)
	Workshop 2	D207	Practitioner Challenges for Academics - Discussion and Idea Generation Workshop (In-Person Only)
	Workshop 3	D105	Practical Malware Analysis and Memory Forensics for Incident Response (In-Person Only)
10:45-11:15	Break
11:15-13:00	Workshop 1	D206	Creating holistic dataset for digital forensics with ForTrace++ (Hybrid)
	Workshop 2	D207	Practitioner Challenges for Academics - Discussion and Idea Generation Workshop (In-Person Only)
	Workshop 3	D105	Practical Malware Analysis and Memory Forensics for Incident Response (In-Person Only)
13:00-14:00	Lunch break
14:00-16:00	Workshop 4	D206	Automatically creating high-quality datasets with Puma (Hybrid – talks only, no technical support)
	Workshop 5	D207	Digital Forensics Doctoral Symposium (DFDS) (Hybrid)
	Workshop 6	D105	Interactive Jupyter Notebooks as friendly interface for digital forensics (Hybrid)
16:00-16:30	Break
16:30-18:00	Workshop 4	D206	Automatically creating high-quality datasets with Puma (Hybrid – talks only, no technical support) (ends at 17:30)
	Workshop 5	D207	Digital Forensics Doctoral Symposium (DFDS) (Hybrid) (ends at 18:00)
	Workshop 7	D105	Hansken Academic Network Workshop: Collaborating on Digital Forensic Research and Education (Hybrid)
19:00 - ??	Welcome Reception	BUT Rectorate, Antonínská 548/1, 602 00 Brno-střed-Veveří

Time	Event
08:30	Registration Opens
08:30-09:00	Networking
09:00-09:30	Welcome address
09:30-10:30	Keynote: From Blueprint to Reality: The Journey of Building a Decryption Platform Dr. Iwen Coisel Digital Forensic Examiner, European CyberCrime Centre (EC3) - Europol Abstract: During this keynote, I want to share with you the journey I had when building a decryption platform. While the path had its challenges, I learned invaluable lessons along the way, and I’m excited to share that experience with you. I’ll take you through the entire process of creating the platform, from the initial design to deployment, and even the vision for its future. You’ll hear about the early stages, where we explored different ideas and created prototypes to find the best approach. I'll share the decisions we made in choosing the right tools and technologies to ensure the platform could scale and perform at the level needed. Along the way, we made bold choices, including adopting cutting-edge technologies, that were essential to the platform’s success. But it wasn’t without its obstacles. I’ll be sharing the key lessons I learned, the successes as well as the mistakes, and how they shaped the direction of the project. Finally, I’ll discuss what comes next for the platform, and how we plan to evolve it further. This keynote is not just about the technical journey, it’s about the personal experience, the decisions, and the lessons learned that I hope will be valuable for you in your own work.
10:30-11:00	Break
11:00-13:00	Paper Session: Mobile & IoT Session Chair: Sean McKeown
	Forensic analysis of Telegram Messenger on iOS Smartphones	Lukas Jaeckel, Michael Spranger and Dirk Labudde
	Tapping .IPAs: An Automated Analysis of iPhone Applications Using Apple Silicon Macs	Steven Seiden, Andrew Webb and Ibrahim Baggili
	Video Capturing Device Identification through Block-based PRNU Matching	Jian Li, Fei Wang, Bin Ma, Chunpeng Wang and Xiaoming Wu
	Samsung Tracking Tag Application Forensics in Criminal Investigations	Hongseok Yang, Gibum Kim, Sanghyug Han and Mindong Kim
13:00-14:00	Lunch Break
14:00-15:00	Short Presentations Session Chair: Harm van Beek
	Implantable medical devices as personal identification tool: clinical and legal aspects	Alessandra Putrino and Susanna Marinelli
	System Bias in the Interorganisational Environment of Digital Forensics	Laura Vom Kolke, Nina Sunde and Brita Bjørkelo
	Modeling uncertainty factors in digital forensic science	Elénore Ryser
15:00-15:30	Break
15:30-16:30	Paper Session: Memory Session Chair: Ricardo J. Rodríguez
	A Study on the Evolution of Kernel Data Types Used in Memory Forensics and Their Dependency on Compilation Options	Andrea Oliveri, Nikola Nemes, Branislav Andelic and Davide Balzarotti
	A Scenario-Based Quality Assessment of Memory Acquisition Tools and its Investigative Implications	Lisa Rzepka, Jenny Ottmann, Radina Stoykova, Felix Freiling and Harald Baier
16:30-17:00	Lightning Talks Session Chair: Daryl Pfeif
(Opens 19:00) 19:30-20:30	Banquet and Awards Ceremony at Starobrno Brewery
20:30-23:00	Forensic Rodeo at Starobrno Brewery

Time	Event
08:30-9:00	Registration
09:00-10:00	Keynote Col. PhDr. Jiří Štochl, LL.M., MBA Head of Cybercrime and Electrical Engineering, Police of the Czech Republic Abstract: In my keynote presentation, I will introduce the Police of the Czech Republic and its IT Forensics Department, detailing the processes involved in data acquisition across the country with a focus on expert evidence. I will outline the primary areas of interest in data acquisition, covering a broad spectrum of devices - from mobile phones, PCs, and servers to Apple devices, aircraft systems, vehicle forensics, and wearable technology. Additionally, we will explore the acquisition of non-standard devices such as wearable gadgets, medical devices, and vehicle forensics systems, discussing the possibilities they offer, the skills required, and the challenges faced. To bring these topics to life, I will present a case study of real crime cases involving data acquisition from non-standard devices.
10:00-11:00	Poster Session Session Chair: Ricardo J. Rodríguez
11:00-11:30	Break
11:30-13:00	Paper Session: Digital Forensic Science Session Chair: Stefan Axellson
	Preserving Meaning of Evidence from Evolving Systems	Hannes Spichiger and Frank Adelstein
	SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT&CK	Christopher Hargreaves, Harm van Beek and Eoghan Casey
	A Metrics-Based Look at Disk Images: Insights and Applications	Lena Lucia Voigt, Felix Freiling and Chris Hargreaves
13:00-14:00	Lunch Break & Virtual BoF Session
14:00-15:30	Paper Session: AI in Digital Forensics Session Chair: Katerina Kanta
	Beyond the Dictionary Attack: Enhancing Password Cracking Efficiency through Machine Learning-Induced Mangling Rules	Radek Hranický, Lucia Šírová and Viktor Rucký
	PaSSw0rdVib3s!: AI-assisted Password Recognition for Digital Forensic Investigations	Romke van Dijk, Judith van de Wetering, Ranieri Argentini, Leonie Gorka, Anne Fleur van Luenen, Sieds Minnema, Edwin Rijgersberg, Mattijs Ugen, Zoltan Mann and Zeno Geradts
	ForensicLLM: A Local Large Language Model for Digital Forensics	Binaya Sharma, James Ghawaly, Kyle McCleary, Andrew Webb and Ibrahim Baggili
15:30-16:00	Break
16:00-17:00	Short Presentations Session Chair: Blanche Lagny
	Secrets in Motion: Dynamic TLS Key Recovery	Daniel Baier and Martin Lambertz
	Mobint – an advanced platform supporting integration and analysis of mobile data coming from various sources	Kamil Piętak, Jacek Dajda and Marek Kisiel-Dorohinicki
	Deep Reasoning and Large Context Windows: Next-Generation AI in Digital Forensic Investigations	Hans Henseler and Timo Meconi
19:30	Networking at U Královny Elišky wine bar/cellar

Time	Event
09:30-10:30	Paper Session: Session Chair: Jens-Petter Sandvik
	Beyond Hamming Distance: Exploring Spatial Encoding in Perceptual Hashes	Sean McKeown
	When is Logging Sufficient? — Tracking event causality for improved forensic analysis and correlation	Johannes Olegård, Stefan Axelsson and Yuhong Li
10:30 - 11:00	Break
11:00 - 12:00	Paper Session: Cryptocurrency Session Chair: Radek Hranicky
	Unmixing the Mix: Patterns and Challenges in Bitcoin Mixer Investigations	Pascal Tippe and Christoph Deckers
	Tumbling Down the Stairs: Exploiting a Tumbler’s Attempt to Hide with Ordinary-looking Transactions using Wallet Fingerprinting	Jan Zavřel, Michal Koutenský, Vladimír Veselý and Daniel Dolejška
12:00 - 13:15	Future Planning Session
14:00 - 17:00	DFRWS Expedition Meet up at Brno Technical Museum (please make sure to arrive on time).

• Automatically creating high-quality test data with Puma
• Creating holistic data sets for digital forensics with ForTrace++
• Hansken Academic Network Workshop: Collaborating on Digital Forensic Research and Education
• Interactive Jupyter Notebooks as friendly interface for digital forensics
• Practical Malware Analysis and Memory Forensics for Incident Response
• Practitioner Challenges for Academics – Discussion and Idea Generation Workshop

• AI-Enhanced Virtual Crime Scene Generation
• A Framework for Integrated Digital Forensic Investigation Employing AutoGen AI Agents
• A Methodology for Event Log Generation from Unstructured Digital Forensics Data
• Computer Vision for Indoor Multimedia Geolocation
• Deepfake Forensics: Exploring the Impact and Implications of Fabricated Media in Digital Forensic Investigations
• (Digital) Stratigraphy and Other Chronological Dating Techniques
• Evaluative Assessment of Digital Evidence
• ForensicGPT: Enhancing and Standardizing Digital Forensic Capabilities with RAG㎿Based LLMs
• Illegal Bitcoin Transaction Detection Using Pre-trained Language Models (BERT and Variants)
• Retrieving Cloud Conversation Records of Xiaomi Smart Speaker
• YAFED – Yet Another (Mobile) Forensic Extraction Device

 

• A Metrics-Based Look at Disk Images: Insights and Applications
  Lena Lucia Voigt (Friedrich-Alexander-Universität Erlangen-Nürnberg), Felix Freiling (Friedrich-Alexander-Universität Erlangen-Nürnberg), Chris Hargreaves (HARGS Solutions Ltd)
  
• A Scenario-Based Quality Assessment of Memory Acquisition Tools and its Investigative Implications
  Lisa Rzepka (Universität der Bundeswehr München), Jenny Ottmann (Friedrich-Alexander-Universität Erlangen-Nürnberg), Radina Stoykova (University of Groningen), Felix Freiling (Friedrich-Alexander-Universität Erlangen-Nürnberg), Harald Baier (Universität der Bundeswehr München)
  
• A Study on the Evolution of Kernel Data Types Used in Memory Forensics and Their Dependency on Compilation Options
  Andrea Oliveri (EURECOM), Nikola Nemes (University of Novi Sad), Branislav Andelic (University of Novi Sad), Davide Balzarotti (EURECOM)
  
• Beyond Hamming Distance: Exploring Spatial Encoding in Perceptual Hashes
  Sean McKeown (Edinburgh Napier University)
  
• Beyond the Dictionary Attack: Enhancing Password Cracking Efficiency through Machine Learning-Induced Mangling Rules
  Radek Hranický (Brno University of Technology), Lucia Šírová (Brno University of Technology), Viktor Rucký (Brno University of Technology)
  
• Forensic analysis of Telegram Messenger on iOS Smartphones
  Lukas Jaeckel (Mittweida University of Applied Sciences), Michael Spranger (Mittweida University of Applied Sciences), Dirk Labudde (Mittweida University of Applied Sciences)
  
• ForensicLLM: A Local Large Language Model for Digital Forensics
  Binaya Sharma (Louisiana State University), James Ghawaly (Louisiana State University), Kyle McCleary (Louisiana State University), Andrew Webb (Louisiana State University), Ibrahim Baggili (Louisiana State University)
  
• PaSSw0rdVib3s!: AI-assisted Password Recognition for Digital Forensic Investigations
  Romke van Dijk (Netherlands Forensic Institute), Judith van de Wetering (Netherlands Forensic Institute), Ranieri Argentini (Netherlands Forensic Institute), Leonie Gorka (Netherlands Forensic Institute), Anne Fleur van Luenen (Netherlands Forensic Institute), Sieds Minnema (Netherlands Forensic Institute), Edwin Rijgersberg (Netherlands Forensic Institute), Mattijs Ugen (Netherlands Forensic Institute), Zoltan Mann (University of Amsterdam), Zeno Geradts (University of Amsterdam, Netherlands Forensic Institute)
  
• Preserving Meaning of Evidence from Evolving Systems
  Hannes Spichiger (Hochschule Luzern HSLU), Frank Adelstein (Hexordia)
  
• Samsung Tracking Tag Application Forensics in Criminal Investigations
  Hongseok Yang (Sungkyunkwan University), Gibum Kim (Sungkyunkwan University), Sanghyug Han (Sungkyunkwan University), Mindong Kim (Sungkyunkwan University)
  
• SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT&CK
  Christopher Hargreaves (University of Oxford), Harm van Beek (Netherlands Forensic Institute), Eoghan Casey (University of Lausanne)
  
• Tapping .IPAs: An Automated Analysis of iPhone Applications Using Apple Silicon Macs
  Steven Seiden (Louisiana State University), Andrew Webb (Louisiana State University), Ibrahim Baggili (Louisiana State University)
  
• Tumbling Down the Stairs: Exploiting a Tumbler’s Attempt to Hide with Ordinary-looking Transactions using Wallet Fingerprinting
  Jan Zavřel (Brno University of Technology), Michal Koutenský (Brno University of Technology), Vladimír Veselý (Brno University of Technology), Daniel Dolejška (Brno University of Technology)
  
• Unmixing the Mix: Patterns and Challenges in Bitcoin Mixer Investigations
  Pascal Tippe (FernUniversität in Hagen), Christoph Deckers (FernUniversität in Hagen)
  
• Video Capturing Device Identification through Block-based PRNU Matching
  Jian Li (Qilu University of Technology), Fei Wang (Qilu University of Technology), Bin Ma (Qilu University of Technology), Chunpeng Wang (Qilu University of Technology), Xiaoming Wu (Qilu University of Technology)
  
• When is Logging Sufficient?
  Johannes Olegård (Stockholm University), Stefan Axelsson (Stockholm University), Yuhong Li (Stockholm University)