EU 2026 Program

Jump to: Mon – Tue – Wed – Thu – Fri – Accepted Workshops – Accepted Posters – Accepted Papers – Return to the Main Page

Sign up for the conference: Registration

Please note: This is the preliminary program, which is subject to change.

Workshop Day
A-building (Entrance 17), Linköping University, Linköping

Time	Track 1 Room A2	Track 2 Room A1	Track 3 Room ACAS	Track 4 Conference Room PALMBERGET
08:00–09:00	Registration AGORA – Square outside A2/ACAS
09:00–10:45	Digital Forensics Doctoral Symposium (Hybrid) Part I		Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic (Hybrid) Erik Hjelmvik (Netresec) Part I	Quickboot (Exploiting a Tiny Bootloader) (Onsite only) Richard Buurke (Netherlands Forensic Institute) Part I
10:45–11:00	Coffee Break
11:00–12:45	Digital Forensics Doctoral Symposium (Hybrid) Part II		Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic (Hybrid) Part II	Quickboot (Exploiting a Tiny Bootloader) (Onsite only) Part II
12:45–13:45	Lunch Kårallen (separate building)
13:45–15:30	LLM Prompt Engineering for Digital Forensics (Hybrid) Akila Shamendra Wickramasekara, Mark Scanlon (University College Dublin) Part I	Making Use of the SOLVE-IT Digital Forensics Knowledge Base (Hybrid) Chris Hargreaves (HARGS Solutions) Part I	Shaping the Future of Digital Forensics (Onsite only) Lena Widin Klasén, Niclas Fock, Fredrik Viksten, Robert Forchheimer (Linköping University) Part I
15:30–15:45	Coffee Break
15:45–17:30	LLM Prompt Engineering for Digital Forensics (Hybrid) Part II	Making Use of the SOLVE-IT Digital Forensics Knowledge Base (Hybrid) Part II	Shaping the Future of Digital Forensics (Onsite only) Part II
18:00	Recruitment Fair AGORA – Square outside A2/ACAS
18:00 (~20:30)	Welcome Reception C-huset, Linköping University

Conference Day 1
Main Conference Room A2, A-building (Entrance 17), Linköping University, Linköping

Time	Event
07:00–08:00	Morning run to explore the beautiful nature in Linköping (max 15 participants) Please sign up via the conference Discord.
08:00–09:00	Registration AGORA – Square outside A2/ACAS
09:00–09:30	Welcome Address
09:30–10:30	Keynote – Visions of digital policing Hjørdis Birgitte Ellefsen (Norwegian Police University College) and Heidi Mork Lomell (University of Oslo) Abstract: What is new, and what is old, in contemporary visions of what technology and digitalization can do for the police? While researchers have explored the many effects and consequences that digital information technology has had on policing, we know little about what happened when the very first digital policing tools were developed and implemented. In this presentation, we explore how digitalization was envisioned and introduced to the Norwegian police in the 1960s and 70s at the dawn of the digital age. We find that private tech-industry was a key agent in the computerization of the Norwegian police, promoting EDP (Electronic Data Processing) as a tool for more effective policing that could predict, control, and detect crime with scientific precision. Due to lack of technological competence and resources, the Norwegian police became highly dependent on the facilitation, training and advise of private tech-industry, which also affected how the police understand themselves and their function in society. Investigating how the visions of entrepreneurs were translated into collectively held reference points, our study gives insight into the origination and embedding of “sociotechnical imaginaries” (Jasanoff, 2015) that has laid ground for how we today understand the fundamental nature of technology, crime and policing, and how we envision the future.
10:30–10:55	Paper Session I: Memory Forensics – Part I Session Chair: Janine Schneider
	LEMON: eBPF-based Volatile Memory Acquisition by Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
10:55–11:25	Coffee Break with Networking – AGORA
11:25–12:30	Paper Session I: Memory Forensics – Part II Session Chair: Janine Schneider
	Structural Analysis of the Windows NT Heap by Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
	Resilience of Forensic Evidence Acquisition Under Database Schema Drift by Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
	Presentation Session I
	Beyond Disk Artifacts: Live Symmetric Key Extraction from Windows Ransomware via File System–Driven Memory Analysis by Julian Lengersdorff and Daniel Baier
12:30–13:30	Lunch & Birds of a Feather (online)
13:30–15:00	Paper Session II: File and Data Forensics Session Chair: Ricardo J. Rodriguez
	CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations by Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
	REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction by Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park
	Needle in a case: Scalable search over large-scale image corpora in forensic applications by Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
	Presentation Session II
	Following the ‘Find My’ Trail: AirTag Data Analysis for Digital Investigators by Bethany Morgan
15:00–15:30	Break
15:30–16:45	Paper Session III: AI in Digital Forensics Session Chair: Lena Voigt
	Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation by Michael Plankl, Thomas Göbel and Harald Baier
	Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value by Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
	Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! by Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
16:45–16:55	Lightning Talks I
16:55–17:00	Closing Words
17:00–18:20	Time on your own. For shuttle-bus users (booking required at DFRWS concierge desk): Departure at 18:20 from Scandic Frimurare Hotel and 18:30 from Scandic Väst Hotel.
19:00–23:00	Banquet, Awards Ceremony & Forensic Rodeo – Swedish Air Force Museum Dress code: Casual, or as you prefer. Return bus transfer approximately 23:00

 

Conference Day 2
Main Conference Room A2, A-building (Entrance 17), Linköping University, Linköping

Time	Event
08:00–09:00	Registration AGORA – Square outside A2/ACAS
09:00–10:00	Keynote – The Need for Forensics in the Age of Hybrid Warfare Dr. Emil Hjalmarson (Swedish Defence) Abstract: Hybrid warfare increasingly blurs the boundaries between peace and conflict, civil and military domains, and state and non-state actors. In this environment, digital traces, technical indicators, and fragmented data sets play a critical role in understanding intent, attribution, and escalation. This keynote explores the evolving landscape of hybrid warfare and the impact on forensics as a strategic capability. Drawing on experiences from cyber defence and defence-related AI research, the talk examines how forensic methods are applied in military and law enforcement contexts. While police-led forensics is typically shaped by legal thresholds, evidentiary standards, and judicial processes, military forensics operates under distinct conditions and often different objectives — spanning from supporting both operational and strategic decision-making to judicial processed related to war crimes. These differing premises influence every stage of the forensic process: data collection, analysis, documentation, sharing, and use of results. The presentation further explores how these two traditions increasingly intersect in hybrid scenarios, where the same technical artefacts may serve tactical response, strategic attribution, and potential legal accountability. It will also highlight selected elements from the European Forensic Science Area’s action plan that are particularly relevant to digital forensics. By linking technical practice with strategic and organizational perspectives, this keynote aims to stimulate discussion on how the forensic community can adapt to hybrid threats while navigating the divergent demands of military and civilian security environments.
10:00–10:30	Coffee Break with Networking – AGORA
10:30–11:45	Paper Session IV: Mobile Device Forensics Session Chair: Jan-Niclas Hilgert
	Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices by Samuele Mombelli and Thomas R. Souvignet
	Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach by Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
	The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS by Katharina De Rentiis, Julian Geus and Felix Freiling
11:45–12:30	Presentation Session III Session Chair: Niclas Fock / Lena Klasén
	Insights into Real-World Disk Images from Fiscal Inheritance Cases by Lena Lucia Voigt
	A case study of analysing a navigation app for motorcyclists that was used during a traffic accident by Maria Clausing
	Forensics of Meta Devices: Acquisition Techniques for Quest Headsets and Ray-Ban Smartglasses by Riccardo Bianchi and Thomas R. Souvignet
12:30–13:30	Lunch
13:30–14:45	Paper Session V: Network and Emerging Forensics Session Chair: Áine MacDermott
	DroPTC: Sentence-Level Drone Flight Log Forensics Using Contrastive Learning and Explainable AI by Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
	Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server by Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
	Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation by Kanwal Aftab, Graham Adams and Mark Scanlon
14:45–15:10	Short Presentations of Posters
15:10–16:00	Break with Poster Session
16:00–17:05	Paper Session VI: Forensic Tools and Evaluation Session Chair: Sean McKeown
	AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation by Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
	Ctrl+Alt+Deceit: Policing the Deepfake Dilemma by Áine MacDermott
	Presentation Session IV
	Towards Sovereign AI Architectures for Complex Digital Investigations by Jacob Isaksen
17:05–17:15	Lightning Talks II
17:15–17:30	Closing Words
17:30–19:30	Time on your own
Evening	Free Evening We recommend gathering at De Klomp in downtown Linköping S:t Larsgatan 13 – Traditional Swedish food and selection of craft beers.

Conference Day 3 & DFRWS Expedition
Change location to Cnema/Visualiseringscenter C, Norrköping

Time	Event
07:30–08:30	Shuttle-bus to Cnema/Visualiseringscenter C, Norrköping For shuttle-bus users (booking required at DFRWS concierge desk): Departure at 7:30 from Scandic Frimurare Hotel and 7:40 from Scandic Väst Hotel.
08:30–08:50	Coffee / tea at arrival in Cnema
08:50–09:00	Welcome Please note that the Norrköping location will have limited power outlets for charging devices.
09:00–10:20	Paper Session VII: Multimedia Forensics Tracks Session Chair: Jens-Petter Sandvik
	Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection by Fabrizio Casadei, Luca Maiano and Irene Amerini
	VAAS: Vision-Attention Anomaly Scoring for Image Manipulation Detection in Digital Forensics by Opeyemi Bamigbade, Mark Scanlon and John Sheppard
	Boon or Bane: Source Camera Identification meets AI-generated Images by Samantha Klier and Harald Baier
10:20–10:40	Speaker: National Police Commissioner, Petra Lundh
10:40–11:00	Coffee / tea break in Visualiseringscenter C
11:00–12:45	Exhibition: Visual Crime Scene, human organ atlas, Wisdome (Experience science in 360° immersive 3D) and more!
12:45–13:45	Lunch
13:45–15:00	DFRWS Expedition – Norrköping Guided city tour for attendees staying beyond the conference (pre-booked only)
12:45, *13:45, **15:15	Shuttle-bus to Norrköping Central Station & *Linköping City Airport For shuttle-bus users (booking required at DFRWS concierge desk): 12:45 → Norrköping Central Station *13:45 → Norrköping Central Station →  Linköping City Airport **15:15 → Norrköping Central Station →  Linköping City Airport →  Scandic Väst & Firmurare hotel in Linköping

 

 

• Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic
  Erik Hjelmvik (Netresec, Sweden)
• Shaping the Future of Digital Forensics
  Lena Widin Klasén, Niclas Fock, Fredrik Viksten and Robert Forchheimer (Linköping University, Sweden)
• Quickboot (Exploiting a Tiny Bootloader)
  Richard Buurke (Netherlands Forensic Institute, The Netherlands)
• Making Use of the SOLVE-IT Digital Forensics Knowledge Base
  Chris Hargreaves (HARGS Solutions Ltd, UK)
• LLM Prompt Engineering for Digital Forensic
  Akila Shamendra Wickramasekara and Mark Scanlon (University College Dublin, Ireland)
• Applied Digital Forensics Techniques for Crimes Against Children Investigators
  Project VIC International and partners (MSAB, Child Rescue Coalition, Web-IQ, Griffeye, Swedish Police)

• A Multi-Feature Fusion Based Method for Detecting Illicit Bitcoin Transactions
  • Liu, Qingpu Zhang and Chuanhong Chu
• AI-based face super resolution for forensic evaluation: a trustworthiness analysis
  • Rocco Mazzei, Massimo Iuliani, Marco Fontani, Martino Jeria and Mauro Barni
• CAMKRIPTO: A Pre-Generated Control Wallet Framework for A Robust Chain of Custody in Virtual Asset Seizures
  • CyberSecurity Malaysia
• Computer Vision for Indoor Multimedia Geolocation
  • Kanwal Aftab and Mark Scanlon
• Digital Forensic Profiling with Demographic Attributes: A Research Agenda
  • Marion Liegl
• Examining system bias: Bias, errors, and misunderstandings in a digital forensic examination
  • Nina Sunde, Laura Vom Kolke and Brita Bjørkelo
• Forensic Attribution of CarPlay-Initiated Calls via iOS Unified Logs
  • Florian Champalou
• From Clues to Causal Chains: Constraint-Driven Event Reconstruction
  • Lorenz Hornung and Jan Gruber
• Lifecycle of Automated Digital Forensic Analysis Using Machine Learning
  • S. P. Krišákovám, P. Sokol, M. Bača, R. Slíž and M. Mikuláš
• Raster Domain Text Steganography: A Unified Glyph Level Framework for Multimodal Secure Embedding
  • Uday Kiran Kandala
• Revealing the Expected: A Survey about Memory Forensic in Practice
  • Lisa Rzepka, Benedikt Mader, Zinaida Benenson and Harald Baier

Main Track

• • LEMON: A Universal eBPF-based Volatile Memory Acquisition Tool for Modern Android Devices and Hardened Linux Systems
    Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
  • Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices
    Samuele Mombelli and Thomas R. Souvignet
  • Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach
    Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
  • The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS
    Katharina De Rentiis, Julian Geus and Felix Freiling
  • Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server
    Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
  • Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value
    Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
  • DroPTC: Sentence-Level Drone Flight Log Forensics Using Contrastive Learning and Explainable AI
    Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
  • Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
    Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
  • Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation
    Michael Plankl, Thomas Göbel and Harald Baier
  • CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations
    Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
  • AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation
    Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
  • Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation
    Kanwal Aftab, Graham Adams and Mark Scanlon
  • Needle in a case: Scalable search over large-scale image corpora in forensic applications
    Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
  • Ctrl+Alt+Deceit: Policing the Deepfake Dilemma
    Áine MacDermott
  • Resilience of Forensic Evidence Acquisition Under Database Schema Drift
    Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
  • Structural Analysis of the Windows NT Heap for Memory Forensics
    Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
  • REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction
    Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park

Multimedia Forensics Mini-Track

• Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection
  Fabrizio Casadei, Luca Maiano and Irene Amerini
• VAAS: Vision-Attention Anomaly Scoring for Image Manipulation Detection in Digital Forensics
  Opeyemi Bamigbade, Mark Scanlon and John Sheppard
• Boon or Bane: Source Camera Identification meets AI-generated Images
  Samantha Klier and Harald Baier