EU 2026 Program

Jump to: Mon – Tue – Wed – Thu – Fri – Accepted Workshops – Accepted Posters – Accepted Papers
Sign up for the conference: Registration

Please note: This is the preliminary program, which is subject to change.

Workshop Day

Time	Track 1 Room A2	Track 2 Room A1	Track 3 Room ACAS	Track 4 Conference Room PALMBERGET
08:00–09:00	Registration
09:00–10:45	Digital Forensics Doctoral Symposium Part I		Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic Erik Hjelmvik (Netresec) Part I	Quickboot (Exploiting a Tiny Bootloader) Richard Buurke (Netherlands Forensic Institute) Part I
10:45–11:00	Coffee Break
11:00–12:45	Digital Forensics Doctoral Symposium Part II		Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic Part II	Quickboot (Exploiting a Tiny Bootloader Part II
12:45–13:45	Lunch Kårallen (separate building)
13:45–15:30	LLM Prompt Engineering for Digital Forensics Akila Shamendra Wickramasekara, Mark Scanlon (University College Dublin) Part I	Making Use of the SOLVE-IT Digital Forensics Knowledge Base Chris Hargreaves (HARGS Solutions) Part I	Shaping the Future of Digital Forensics Lena Widin Klasén, Niclas Fock, Fredrik Viksten, Robert Forchheimer (Linköping University) Part I
15:30–15:45	Coffee Break
15:45–17:30	LLM Prompt Engineering for Digital Forensics Part II	Making Use of the SOLVE-IT Digital Forensics Knowledge Base Part II	Shaping the Future of Digital Forensics Part II
18:00	Recruitment Fair AGORA – Square outside A2/ACAS
18:00 (~20:30)	Welcome Reception C-huset, Linköping University

Conference Day 1

Time	Event
08:00–09:00	Registration – Location: A2
09:00–09:30	Welcome Address
09:30–10:30	Keynote – Visions of digital policing Hjørdis Birgitte Ellefsen (Norwegian Police University College) and Heidi Mork Lomell (University of Oslo) Abstract: What is new, and what is old, in contemporary visions of what technology and digitalization can do for the police? While researchers have explored the many effects and consequences that digital information technology has had on policing, we know little about what happened when the very first digital policing tools were developed and implemented. In this presentation, we explore how digitalization was envisioned and introduced to the Norwegian police in the 1960s and 70s at the dawn of the digital age. We find that private tech-industry was a key agent in the computerization of the Norwegian police, promoting EDP (Electronic Data Processing) as a tool for more effective policing that could predict, control, and detect crime with scientific precision. Due to lack of technological competence and resources, the Norwegian police became highly dependent on the facilitation, training and advise of private tech-industry, which also affected how the police understand themselves and their function in society. Investigating how the visions of entrepreneurs were translated into collectively held reference points, our study gives insight into the origination and embedding of “sociotechnical imaginaries” (Jasanoff, 2015) that has laid ground for how we today understand the fundamental nature of technology, crime and policing, and how we envision the future.
10:30–10:55	Paper Session I: Memory Forensics – Part I Session Chair: Janine Schneider
	LEMON: eBPF-based Volatile Memory Acquisition by Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
10:55–11:25	Coffee Break with Networking – AGORA
11:25–12:30	Paper Session I: Memory Forensics – Part II Session Chair: Janine Schneider
	Structural Analysis of the Windows NT Heap by Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
	Resilience of Forensic Evidence Acquisition Under Database Schema Drift by Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
	Presentation Session I
	Beyond Disk Artifacts: Live Symmetric Key Extraction from Windows Ransomware via File System–Driven Memory Analysis by Julian Lengersdorff and Daniel Baier
12:30–13:30	Lunch & Birds of a Feather (online)
13:30–15:00	Paper Session II: File and Data Forensics Session Chair: Ricardo J. Rodriguez
	CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations by Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
	REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction by Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park
	Needle in a case: Scalable search over large-scale image corpora in forensic applications by Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
	Presentation Session II
	Following the ‘Find My’ Trail: AirTag Data Analysis for Digital Investigators by Bethany Morgan
15:00–15:30	Break
15:30–16:45	Paper Session III: AI in Digital Forensics Session Chair: Lena Voigt
	Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value by Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
	Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! by Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
	Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation by Michael Plankl, Thomas Göbel and Harald Baier
16:45–16:55	Lightning Talks I
16:55–17:00	Closing Words
17:00–18:30	Time on your own
19:00–23:00	Banquet, Awards Ceremony & Forensic Rodeo – Swedish Air Force Museum Return bus transfer approximately 23:00

Conference Day 2

Time	Event
08:00–09:00	Registration – Location: A2
09:00–10:00	Keynote – The Need for Forensics in the Age of Hybrid Warfare Dr. Emil Hjalmarson (Swedish Defence) Abstract: Hybrid warfare increasingly blurs the boundaries between peace and conflict, civil and military domains, and state and non-state actors. In this environment, digital traces, technical indicators, and fragmented data sets play a critical role in understanding intent, attribution, and escalation. This keynote explores the evolving landscape of hybrid warfare and the impact on forensics as a strategic capability. Drawing on experiences from cyber defence and defence-related AI research, the talk examines how forensic methods are applied in military and law enforcement contexts. While police-led forensics is typically shaped by legal thresholds, evidentiary standards, and judicial processes, military forensics operates under distinct conditions and often different objectives — spanning from supporting both operational and strategic decision-making to judicial processed related to war crimes. These differing premises influence every stage of the forensic process: data collection, analysis, documentation, sharing, and use of results. The presentation further explores how these two traditions increasingly intersect in hybrid scenarios, where the same technical artefacts may serve tactical response, strategic attribution, and potential legal accountability. It will also highlight selected elements from the European Forensic Science Area’s action plan that are particularly relevant to digital forensics. By linking technical practice with strategic and organizational perspectives, this keynote aims to stimulate discussion on how the forensic community can adapt to hybrid threats while navigating the divergent demands of military and civilian security environments.
10:00–10:30	Coffee Break with Networking – AGORA
10:30–11:45	Paper Session IV: Mobile Device Forensics Session Chair: Jan-Niclas Hilgert
	Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices by Samuele Mombelli and Thomas R. Souvignet
	Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach by Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
	The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS by Katharina De Rentiis, Julian Geus and Felix Freiling
11:45–12:30	Presentation Session III Session Chair: Niclas Fock / Lena Klasén
	Insights into Real-World Disk Images from Fiscal Inheritance Cases by Lena Lucia Voigt
	A case study of analysing a navigation app for motorcyclists that was used during a traffic accident by Maria Clausing
	Forensics of Meta Devices: Acquisition Techniques for Quest Headsets and Ray-Ban Smartglasses by Riccardo Bianchi and Thomas R. Souvignet
12:30–13:30	Lunch
13:30–14:45	Paper Session V: Network and Emerging Forensics Session Chair: Áine MacDermott
	Interpretable root cause analysis of drone flight logs by Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
	Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server by Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
	Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation by Kanwal Aftab, Graham Adams and Mark Scanlon
14:45–15:10	Short Presentations of Posters
15:10–16:00	Break with Poster Session
16:00–17:05	Paper Session VI: Forensic Tools and Evaluation Session Chair: Sean McKeown
	AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation by Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
	Ctrl+Alt+Deceit: Policing the Deepfake Dilemma by Áine MacDermott
	Presentation Session IV
	Towards Sovereign AI Architectures for Complex Digital Investigations by Jacob Isaksen
17:05–17:15	Lightning Talks II
17:15–17:30	Closing Words
17:30–19:30	Time on your own
Evening	Free Evening We recommend gathering at De Klomp in downtown Linköping S:t Larsgatan 13 – Traditional Swedish food and selection of craft beers.

Conference Day 3 & DFRWS Expedition

Time	Event
08:00–08:40	Bus transfer to Cnema/Visualiseringscenter C, Norrköping
08:50–09:00	Welcome
09:00–10:20	Paper Session VII: Multimedia Forensics Tracks Session Chair: Jens-Petter Sandvik
	Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection by Fabrizio Casadei, Luca Maiano and Irene Amerini
	Vision-Attention Anomaly Scoring (VAAS) for Image Manipulation Detection in Digital Forensics by Opeyemi Bamigbade, Mark Scanlon and John Sheppard/span>
	Boon or Bane: Source Camera Identification meets AI-generated Images by Samantha Klier and Harald Baier
10:20–10:40	Speaker: National Police Commissioner, Petra Lundh
10:40–11:00	Break
11:00–13:00	Exhibition: Visual Crime Scene, human organ atlas, Wisdome, and more!
13:00–14:00	Lunch
14:00–15:30	DFRWS Expedition – Norrköping Guided city tour for attendees staying beyond the conference

• Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic
  Erik Hjelmvik (Netresec, Sweden)
• Shaping the Future of Digital Forensics
  Lena Widin Klasén, Niclas Fock, Fredrik Viksten and Robert Forchheimer (Linköping University, Sweden)
• Quickboot (Exploiting a Tiny Bootloader)
  Richard Buurke (Netherlands Forensic Institute, The Netherlands)
• Making Use of the SOLVE-IT Digital Forensics Knowledge Base
  Chris Hargreaves (HARGS Solutions Ltd, UK)
• LLM Prompt Engineering for Digital Forensic
  Akila Shamendra Wickramasekara and Mark Scanlon (University College Dublin, Ireland)
• Applied Digital Forensics Techniques for Crimes Against Children Investigators
  Project VIC International and partners (MSAB, Child Rescue Coalition, Web-IQ, Griffeye, Swedish Police)

• Posters to be announced

Main Track

• LEMON: A Universal eBPF-based Volatile Memory Acquisition Tool for Modern Android Devices and Hardened Linux Systems
  Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
• Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices
  Samuele Mombelli and Thomas R. Souvignet
• Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach
  Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
• The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS
  Katharina De Rentiis, Julian Geus and Felix Freiling
• Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server
  Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
• Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value
  Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
• Interpretable root cause analysis of drone flight logs
  Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
• Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
  Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
• Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation
  Michael Plankl, Thomas Göbel and Harald Baier
• CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations
  Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
• AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation
  Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
• Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation
  Kanwal Aftab, Graham Adams and Mark Scanlon
• Needle in a case: Scalable search over large-scale image corpora in forensic applications
  Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
• Ctrl+Alt+Deceit: Policing the Deepfake Dilemma
  Áine MacDermott
• Resilience of Forensic Evidence Acquisition Under Database Schema Drift
  Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
• Structural Analysis of the Windows NT Heap for Memory Forensics
  Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
• REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction
  Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park

Multimedia Forensics Mini-Track

• Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection
  Fabrizio Casadei, Luca Maiano and Irene Amerini
• Vision-Attention Anomaly Scoring (VAAS) for Image Manipulation Detection in Digital Forensics
  Opeyemi Bamigbade, Mark Scanlon and John Sheppard
• Boon or Bane: Source Camera Identification meets AI-generated Images
  Samantha Klier and Harald Baier