Jump to: Mon – Tue – Wed – Thu – Fri – Accepted Workshops – Accepted Posters – Accepted Papers

Please note: This is the preliminary program, which is subject to change.

Time	Event	Location
Workshops – Details coming soon
18:00-20:30	Welcome Reception	C-huset, Linköping University

Time	Event	Location
Details coming soon
19:00-22:00	Banquet, Awards Ceremony & Forensic Rodeo Return bus transfer approximately 23:00	Swedish Air Force Museum

Time	Event	Location
Details coming soon
Evening	Free Evening We recommend gathering at a venue in downtown Linköping – details to follow	TBD

Time	Event	Location
Details coming soon
14:00-15:30	DFRWS Expedition Guided city tour for attendees staying beyond the conference	Norrköping

• Hands-on Analysis of Network Packets Carved from Memory & PCAP Analysis of Unencrypted Tor Traffic
  Erik Hjelmvik (Netresec, Sweden)
• Code Blue – Immersive Tabletop into Investigations Using Data from Medical Devices
  Emlyn Butterfield and Veronica Schmitt (Noroff University College, Norway)
• Shaping the Future of Digital Forensics
  Lena Widin Klasén, Niclas Fock, Fredrik Viksten and Robert Forchheimer (Linköping University, Sweden)
• Quickboot (Exploiting a Tiny Bootloader)
  Richard Buurke (Netherlands Forensic Institute, The Netherlands)
• Making Use of the SOLVE-IT Digital Forensics Knowledge Base
  Chris Hargreaves (HARGS Solutions Ltd, UK)
• LLM Prompt Engineering for Digital Forensic
  Akila Shamendra Wickramasekara and Mark Scanlon (University College Dublin, Ireland)

• Posters to be announced

Main Track

• LEMON: A Universal eBPF-based Volatile Memory Acquisition Tool for Modern Android Devices and Hardened Linux Systems
  Andrea Oliveri, Marco Cavenati, Stefano De Rosa, Sudharsun Lakshmi Narasimhan and Davide Balzarotti
• Inside the Black Box: In-Depth Analysis of Geolocation Mechanisms in Android Mobile Devices
  Samuele Mombelli and Thomas R. Souvignet
• Forensic Activity Classification Using Digital Traces from iPhones: A Machine Learning-based Approach
  Conor McCarthy, Jan Peter van Zandwijk, Marcel Worring and Zeno Geradts
• The Investigator’s Friend and Foe: A forensic analysis of GrapheneOS
  Katharina De Rentiis, Julian Geus and Felix Freiling
• Down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server
  Yikai Wang, Xuepei Zhang, Shufan Wu and Yan Cheng
• Ex Machina: A Forensic Evaluation of AI Companion Applications and Their Evidentiary Value
  Kendall Comeaux, Trevor Spinosa, Ali Ghosn and Ibrahim Baggili
• Interpretable root cause analysis of drone flight logs
  Swardiantara Silalahi, Tohari Ahmad, Hudan Studiawan and Frank Breitinger
• Hey GPT-OSS, Looks Like You Got It – Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
  Gaëtan Michelet, Janine Schneider, Aruna Withanage and Frank Breitinger
• Addressing the Dataset Gap Problem with Generative AI: Towards LLM-driven Forensic Scenarios for Dataset Generation
  Michael Plankl, Thomas Göbel and Harald Baier
• CPR: Corrupted PDF Recovery Algorithm for Digital Forensic Investigations
  Seoyoung Kim, Yunji Park, Woobeen Park and Doowon Jeong
• AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation
  Akila Shamendra Wickramasekara, Tharusha Mihiranga Arumadura, Aruna Withanage, Buddhima Weerasinghe, John Sheppard, Frank Breitinger and Mark Scanlon
• Plug to Place: Indoor Multimedia Geolocation from Electrical Sockets for Digital Investigation
  Kanwal Aftab, Graham Adams and Mark Scanlon
• Needle in a case: Scalable search over large-scale image corpora in forensic applications
  Kamil Faber, Dominik Żurek, Kacper Bujak, Monika Selegrat and Kamil Piętak
• Ctrl+Alt+Deceit: Policing the Deepfake Dilemma
  Áine MacDermott
• Resilience of Forensic Evidence Acquisition Under Database Schema Drift
  Afiqah Mohammad Azahari, Andrea Oliveri and Davide Balzarotti
• Structural Analysis of the Windows NT Heap for Memory Forensics
  Daniel Uroz, Abraham Díaz-Campo and Ricardo J. Rodríguez
• REPDF: Repairing Corrupted PDF Files through Font Mapping and Object Relationship Reconstruction
  Seungeun Park, Byeongchan Jeong, Jieon Kim and Jungheum Park

Multimedia Forensics Mini-Track

• Enhancing Abnormality identification: Robust Out-Of-Distribution strategies for Deepfake Detection
  Fabrizio Casadei, Luca Maiano and Irene Amerini
• Vision-Attention Anomaly Scoring (VAAS) for Image Manipulation Detection in Digital Forensics
  Opeyemi Bamigbade, Mark Scanlon and John Sheppard
• Boon or Bane: Source Camera Identification meets AI-generated Images
  Samantha Klier and Harald Baier