Please note: All times below are in Eastern Daylight Savings Time. For clarity, the current time in Baltimore, MD is:
Schedule of Events
| TIMES ARE IN EASTERN | ||
|---|---|---|
| Sunday, July 9 | ||
| 800 | Registration opens | |
| Parallel session | ||
| 845 | Ransomware Simulations: Hands-on Case Studies by Ali Hadi and Mariam Khader (Champlain College) | Providing digital forensics as a service with code notebooks by Harm van Beek (Netherlands Forensic Institute), Quintin Walters (MITRE) and Mattijs Ugen (Netherlands Forensic Institute) |
| 1300 | Lunch | |
| 1400 | Learning Linux Forensic Analysis and Why it Matters by Ali Hadi and Mariam Khader (Champlain College) | Natural Language Processing (NLP) for Digital Forensics by Mia Mohammad Imran, Hala Ali, Kostadin Damevski and Irfan Ahmed (Virginia Commonwealth University) |
| 1815 | End of Day | |
| Monday, July 10 | ||
| 830 | Registration opens | |
| 930 | Welcome remarks | |
| 945 | Keynote: Forensics in Outer Space - What to Find and Where to Find It | Samuel Sanders Visner, Technical Fellow, Aerospace Corporation |
| 1045 | Break | |
| 1115 | Paper Session: Memory Forensics | |
| Session Chair: Irfan Ahmed | ||
| VIRTUAL | Windows Memory Forensics: Identification of (Malicious) Modifications in Memory-Mapped Image Files | Frank Block (Friedrich-Alexander University Erlangen-Nürnberg) |
| Database Memory Forensics: Identifying Cache Patterns for Log Verification | James Wagner (University of New Orleans), Mahfuzul I. Nissan (University of New Orleans) and Alexander Rasin (DePaul University) | |
| As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency | Jenny Ottmann, Üsame Cengiz (both Friedrich-Alexander University Erlangen-Nürnberg), Frank Breitinger (University of Lausanne) and Felix Freiling (Friedrich-Alexander University Erlangen-Nürnberg) | |
| 1245 | Lunch | |
| 1345 | Paper Session: Network and Cloud Forensics | |
| Session Chair: Aisha Ali-Gombe | ||
| Using Relational Graphs for Exploratory Analysis of Network Traffic Data | Milan Cermak, Tatiana Fritzová, Vít Rusňák and Denisa Sramkova (Masaryk University) | |
| PREE: Heuristic Builder for Reverse Engineering of Network Protocols in Industrial Control Systems | Syed Ali Qasim, Wooyeon Jo and Irfan Ahmed (Virginia Commonwealth University) | |
| A Study on Cloud Data Access through Browser Credential Migration in Windows environment | Uk Hur, Soojin Kang, Giyoon Kim, Jongsung Kim (Kookmin University) | |
| 1515 | Break | |
| 1545 | Paper Session: IoT and Car Forensics | |
| Session Chair: James Wagner | ||
| VIRTUAL | IoT Forensics: Analysis of a HIKVISION’s mobile app | Evangelos Dragonas, Costas Lambrinoudakis (both University of Piraeus) and Michael Kotsis (University of West Attica) |
| Dashcam Forensic Investigation Guidelines | Harjinder Lallie (University of Warwick) | |
| 1645 | "Perspectives on Aerospace DFIR" Panel discussion | Sam Visner (Aerospace Corporation), Tomas Pena (L3Harris), Nick Tsamis (MITRE Corp.), and Joel Francis (Watch Center Leader at Space ISAC) VIRTUAL PRESENTER |
| 1730 | Forensic Rodeo Prep Session | |
| afterwards... | Head out to the Brewery for the Welcome Reception | |
| Welcome Reception & Poster / Demos | Peabody Heights Brewery 401 E 30th St, Baltimore, MD 21218 | |
| Tuesday, July 11 | ||
| 930 | Administrative remarks | |
| 945 | Keynote: Revolutionizing Forensic Methodologies for the Next Space Age | Tomas A. Pena, D.Sc., Lieutenant Colonel, USAF (Retired) (L3Harris) |
| 1045 | Break | |
| 1115 | Paper Session: Data, Datasets, and Sharing | |
| Session Chair: Alex Nelson | ||
| Improving Trace Synthesis by Utilizing Computer Vision for User Action Emulation | Lukas Schmidt, Thomas Hupperich (both University of Münster) and Sebastian Kortmann (University of Amsterdam) | |
| Expanding Digital Forensics Education with Artifact Curation and Scalable, Accessible Exercises via the Artifact Genome Project | Cinthya Grajeda, Jessica Berrios, Sankofa Benzo, Emmanuel Ogunwobi (all University of New Haven) and Ibrahim Baggili (Louisiana State University) | |
| Sharing datasets for Digital Forensic: a novel taxonomy and legal concerns | Frank Breitinger (University of Lausanne) and Alexandre Jotterand (id est avocats) | |
| 1245 | Lunch + Birds of Feather | |
| 1345 | Paper Session: Forensics and AI | |
| Session Chair: Syed Ali Qasim | ||
| VIRTUAL | Combining AI and AM -- Improving Approximate Matching through Transformer Networks | Frieder Uhlig, Lukas Struppek, Dominik Hintersdorf (Technical University Darmstadt), Thomas Göbel, Harald Baier (Universität der Bundeswehr München) and Kristian Kersting (Technical University Darmstadt) |
| cRGB_Mem: At the Intersection of Memory Forensics and Machine Learning | Aisha Ali-Gombe, Sneha Sudhakaran (Louisiana State University), Ramyapandian Vijayakanthan (Towson University) and Golden Richard (Louisiana State University) | |
| 1445 | Break with Poster/Demo Session | |
| 1515 | Presentation Session | |
| Session Chair: Adeen Ayub | ||
| The Remapped/Reallocated Sector Conundrum from a digital forensic investigation and data sanitation perspective | Phil Turner (ADISA) | |
| The Quintilian Project - visualising reachable areas | Matthew Sorell (Digital Forensic Sciences Australia Pty Ltd) | |
| SaaS Forensics | Eoghan Casey (OwnBackup) | |
| 1615 | Board of Directors update | |
| 1630 | Lightning Talks | |
| 1715 | Time on your own | |
| 1900 | The Gala Dinner-Awards Banquet and Forensics Rodeo | hosted at the Belvedere. https://www.belvedereandcoevents.com (One East Chase St. Baltimore, MD21202 ) |
| Wednesday, July 12 | ||
| 0930 | Administrative remarks | |
| 0945 | Paper Session: Mobile and Application Forensics | |
| Session Chair: Wietse Venema | ||
| Every Step You Take, I'll be Tracking You: Forensic Analysis of the Tile Tracker Application | Lauren Pace, Lasean Salmon, Christopher Bowen, Ibrahim Baggili and Golden Richard (Louisiana State University) | |
| Factorizing 2FA: Forensic Analysis of Two-Factor Authentication Applications | Jessica Berrios, Elias Mosher, Sankofa Benzo, Cinthya Grajeda (University of New Haven) and Ibrahim Baggili (Louisiana State University) | |
| Systematic Evaluation of Forensic Data Acquisition using Smartphone Local Backup | Julian Geus, Jenny Ottmann and Felix Freiling (Friedrich-Alexander University Erlangen-Nürnberg) | |
| 1115 | Forensic Challenge Announcement (Irfan Ahmed) | |
| 1130 | Closing remarks | |
| 1200 | Lunch: Open Planning Session | Tamber Restaurant tambersrestaurant.com 3327 St Paul St, Baltimore, MD 21218 Planning lunch open to anyone who wants to actively participate in DFRWS to discuss strategies for continuously improving DFRWS and to plan for the USA 2024 event and beyond. |
| 1345 | The Expedition will be held at the National Cryptologic Museum | https://www.nsa.gov/museum/ |
| 1345 | Boarding begins for charter bus to National Cryptologic Museum | CHARTER BUS WILL Begin Boarding at 1:45 34th St. (in front of Wolman and McCoy Halls) (Attendees with personal transport may rendezvous with the group at the museum) |
| 1400 | Bus departs Johns Hopkins University Commons | |
| 1430 -1630 | Tour - National Cryptologic Museum | |
| 1645 | Bus makes a pit stop at BWI Airport / MARC Amtrack station | |
| 1800 | DFRWS Expedition ends | |
| 1900 | Unofficial After Party (pay on your own) | The Brewer's Art https://www.thebrewersart.com/ |