Authors: Gaurav Gogia

DFRWS APAC 2026

Abstract

Modern investigations require analysts to move beyond ad hoc scripts and vendor tooling toward reproducible, extensible forensic pipelines. While traditional workflows rely heavily on manual parsing or monolithic tools, investigators increasingly need the ability to model artifacts, inject custom logic, and compose lightweight tooling tailored to their cases.
This workshop introduces a language agnostic methodology for building forensic tooling from first principles: modelling artifacts, normalizing heterogeneous timestamps, constructing timelines, and embedding custom logic for detection and reconstruction. Participants will implement these concepts using their preferred language (Python, Go, Rust), while the Mutant DSL is used as a convenience layer to demonstrate ergonomic patterns and under the hood mechanics. Mutant is optional and serves only as an illustrative example, similar in spirit to Nugget (DFRWS EU 2018), which showed how domain specific languages can simplify forensic reasoning.

Learning objectives

1. Build reproducible timeline reconstruction pipelines without external databases
2. Inject custom logic for detection, filtering, and artifact correlation
3. Compare implementations across Python, Go, Rust, and Mutant
4. Understand how convenience DSLs (e.g., Mutant) simplify forensic workflows

Target experience level

Intermediate

Workshop description

Introduction & Motivation (10 minutes)

  • The challenge of building custom forensic tools
  • Why investigators need artifact modelling and custom logic
  • Positioning Mutant: a convenient and open-source DSL for forensics
  • Language agnostic framing: Python, Go, Rust, Mutant

Key concept: forensic tooling is method-first, tool-neutral.

Artifact Modeling & Schema Design (20 minutes)

  • What is an artifact schema?
  • Common fields: timestamp, path, process, entity, metadata
  • Designing schemas that survive multi-device stitching
  • Mutant example: concise schema definition
  • Python/Go/Rust equivalents for neutrality

Detecting Timestomping (20 minutes)

  • FILETIME vs Unix timestamps
  • Mismatched timestamp families
  • “Impossible” timestamp sequences
  • Cross artifact timestamp validation

Detecting Malware Hidden in Ads (20 minutes)

  • Ad networks as malware delivery vectors
  • Redirect chains
  • Cookies as forensic artifacts
  • Domain → subdomain → redirect chain
  • Correlating cookies with browsing history

Hunting Malicious Registry Entries (20 minutes)

  • Persistence keys
  • Run/RunOnce
  • Registry-based logic triggers
  • Unusual autorun paths

Q/A and Discussion (30 minutes)

Preparation details

Requirements

  • Laptop
  • Internet
  • Linux VM recommended but it is optional

 

Biography

Gaurav Gogia Dr. Gaurav is a Lead Security Research Engineer @Qualys. He has 6+ years of experience in Detection Engineering, Virtual Patching, & Forensics. He loves conducting & discussing research around Security & Forensics. When he’s not exploring security, he can be found trying out new food cuisines, reading fiction, or playing video games.

Downloads