EU 2026 Program

Jump to: Mon – Tue – Wed – Thu – Fri – Accepted Workshops – Accepted Posters – Accepted Papers
Sign up for the conference: Registration

Please note: This is the preliminary program, which is subject to change.

Workshop Day

Time	Track 1 Room A2	Track 2 Room A1	Track 3 Room ACAS	Track 4 Palmberget
08:00–09:00	Registration
09:00–10:45	Digital Forensics Doctoral Symposium Part I	Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic Erik Hjelmvik (Netresec) Part I	Code Blue – Immersive Tabletop into Investigations Using Data from Medical Devices Emlyn Butterfield, Veronica Schmitt (Noroff University College) Part I	Quickboot (Exploiting a Tiny Bootloader) Richard Buurke (Netherlands Forensic Institute) Part I
10:45–11:00	Coffee Break
11:00–12:45	Digital Forensics Doctoral Symposium Part II	Network Packets & Tor Traffic Part II	Code Blue Part II	Quickboot Part II
12:45–13:45	Lunch Kårallen (separate building)
13:45–15:30	LLM Prompt Engineering for Digital Forensics Akila Shamendra Wickramasekara, Mark Scanlon (University College Dublin) Part I	Making Use of the SOLVE-IT Digital Forensics Knowledge Base Chris Hargreaves (HARGS Solutions) Part I	Shaping the Future of Digital Forensics Lena Widin Klasén, Niclas Fock, Fredrik Viksten, Robert Forchheimer (Linköping University) Part I
15:30–15:45	Coffee Break
15:45–17:30	LLM Prompt Engineering Part II	SOLVE-IT Knowledge Base Part II	Shaping the Future Part II
17:30	Recruitment Fair AGORA – Square outside A2/ACAS
18:00 (~20:30)	Welcome Reception C-huset, Linköping University

Conference Day 1

Time	Event
08:00–09:00	Registration – Location: A2
09:00–09:30	Welcome Address
09:30–10:30	Keynote Speaker to be announced
10:30–10:55	Paper Session I: Memory Forensics – Part I
	LEMON: eBPF-based Volatile Memory Acquisition by Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
10:55–11:25	Coffee Break with Networking – AGORA
11:25–12:30	Paper Session I: Memory Forensics – Part II
	Structural Analysis of the Windows NT Heap by Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
	Resilience of Forensic Evidence Acquisition Under Database Schema Drift by Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
	Presentation Session I
	Beyond Disk Artifacts: Live Symmetric Key Extraction from Windows Ransomware via File System–Driven Memory Analysis by Julian Lengersdorff and Daniel Baier
12:30–13:30	Lunch & Birds of a Feather (online)
13:30–15:00	Paper Session II: Mobile Device Forensics
	Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices by Samuele Mombelli and Thomas R. Souvignet
	Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach by Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
	The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS by Katharina De Rentiis, Julian Geus and Felix Freiling
	Following the ‘Find My’ Trail: AirTag Data Analysis for Digital Investigators by Bethany Morgan
15:00–15:30	Break
15:30–16:45	Paper Session III: AI in Digital Forensics
	Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value by Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
	Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! by Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
	Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation by Michael Plankl, Thomas Göbel and Harald Baier
16:45–16:55	Lightning Talks I
16:55–17:00	Closing Words
17:00–18:30	Time on your own
19:00–22:00	Banquet, Awards Ceremony & Forensic Rodeo – Swedish Air Force Museum Return bus transfer approximately 23:00

Conference Day 2

Time	Event
08:00–09:00	Registration – Location: A2
09:00–10:00	Keynote Speaker to be announced
10:00–10:30	Coffee Break with Networking – AGORA
10:30–11:45	Paper Session IV: File and Data Forensics
	CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations by Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
	REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction by Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park
	Needle in a case: Scalable search over large-scale image corpora in forensic applications by Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
11:45–12:30	Presentation Session II
	Insights into Real-World Disk Images from Fiscal Inheritance Cases by Lena Lucia Voigt
	A case study of analysing a navigation app for motorcyclists that was used during a traffic accident by Maria Clausing
	Forensics of Meta Devices: Acquisition Techniques for Quest Headsets and Ray-Ban Smartglasses by Riccardo Bianchi and Thomas R. Souvignet
12:30–13:30	Lunch
13:30–14:45	Paper Session V: Network and Emerging Forensics
	Interpretable root cause analysis of drone flight logs by Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
	Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server by Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
	Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation by Kanwal Aftab, Graham Adams and Mark Scanlon
14:45–15:10	Short Presentations of Posters
15:10–16:00	Break with Poster Session
16:00–17:05	Paper Session VI: Forensic Tools and Evaluation
	AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation by Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
	Ctrl+Alt+Deceit: Policing the Deepfake Dilemma by Áine MacDermott
	Presentation
	Towards Sovereign AI Architectures for Complex Digital Investigations by Jacob Isaksen
17:05–17:15	Lightning Talks II
17:15–17:30	Closing Words
17:30–19:30	Time on your own
Evening	Free Evening We recommend gathering at a venue in downtown Linköping – details to follow

Conference Day 3 & DFRWS Expedition

Time	Event
Details coming soon
14:00–15:30	DFRWS Expedition – Norrköping Guided city tour for attendees staying beyond the conference

• Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic
  Erik Hjelmvik (Netresec, Sweden)
• Code Blue – Immersive Tabletop into Investigations Using Data from Medical Devices
  Emlyn Butterfield and Veronica Schmitt (Noroff University College, Norway)
• Shaping the Future of Digital Forensics
  Lena Widin Klasén, Niclas Fock, Fredrik Viksten and Robert Forchheimer (Linköping University, Sweden)
• Quickboot (Exploiting a Tiny Bootloader)
  Richard Buurke (Netherlands Forensic Institute, The Netherlands)
• Making Use of the SOLVE-IT Digital Forensics Knowledge Base
  Chris Hargreaves (HARGS Solutions Ltd, UK)
• LLM Prompt Engineering for Digital Forensic
  Akila Shamendra Wickramasekara and Mark Scanlon (University College Dublin, Ireland)
• Applied Digital Forensics Techniques for Crimes Against Children Investigators
  Project VIC International and partners (MSAB, Child Rescue Coalition, Web-IQ, Griffeye, Swedish Police)

• Posters to be announced

Main Track

• LEMON: A Universal eBPF-based Volatile Memory Acquisition Tool for Modern Android Devices and Hardened Linux Systems
  Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
• Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices
  Samuele Mombelli and Thomas R. Souvignet
• Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach
  Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
• The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS
  Katharina De Rentiis, Julian Geus and Felix Freiling
• Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server
  Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
• Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value
  Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
• Interpretable root cause analysis of drone flight logs
  Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
• Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
  Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
• Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation
  Michael Plankl, Thomas Göbel and Harald Baier
• CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations
  Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
• AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation
  Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
• Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation
  Kanwal Aftab, Graham Adams and Mark Scanlon
• Needle in a case: Scalable search over large-scale image corpora in forensic applications
  Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
• Ctrl+Alt+Deceit: Policing the Deepfake Dilemma
  Áine MacDermott
• Resilience of Forensic Evidence Acquisition Under Database Schema Drift
  Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
• Structural Analysis of the Windows NT Heap for Memory Forensics
  Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
• REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction
  Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park

Multimedia Forensics Mini-Track

• Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection
  Fabrizio Casadei, Luca Maiano and Irene Amerini
• Vision-Attention Anomaly Scoring (VAAS) for Image Manipulation Detection in Digital Forensics
  Opeyemi Bamigbade, Mark Scanlon and John Sheppard
• Boon or Bane: Source Camera Identification meets AI-generated Images
  Samantha Klier and Harald Baier