Please note: All times below are in Central Daylight Time.
For clarity, the current time in Chicago, IL is:
Please find our tentative program items below. Schedules are still work in progress.
Schedule of Events
| Times are in Central Daylight Time (CDT) | |||
|---|---|---|---|
| Tuesday, July 22 | Day 1 | ||
| Location: DePaul Loop Campus -- DePaul Center, 1 E Jackson (8th Floor) | |||
| 08:00 | Registration opens | ||
| Parallel session | |||
| 08:30 short break at 10:30 | WORKSHOP 1: Adapting to evolving threats and strengthening security with Purple Teams | WORKSHOP 2: From Narrow AI to Generative AI: Integrating AI in Your Daily DFIR Life | WORKSHOP 3: Forensic Procedures Under the Microscope -- Improving Forensic Rigor with SOLVE-IT |
| 13:00 | Lunch (1 hour) | DePaul Center, 1 E Jackson Blvd (11th Floor) | |
| Parallel session | |||
| 14:00 short break at 15:30 | WORKSHOP 4: Kubernetes Security -- Hands-On Attack and Defense | WORKSHOP 5: Modern Memory Forensics with Volatility 3 | WORKSHOP 6: Empowering ICAC Investigators and Digital Forensics Examiners: Leveraging Free and Emerging Tools in Digital Forensics to Find and Rescue Children from Sexual Exploitation |
| 18:00 | End of Workshops | ||
| afterwards | Social activities: After Hours Meetup - Informal Networking (on your own) The Exchequer - 226 S Wabash Avenue |
||
| End of day 1 | |||
| Wednesday, July 23 | Day 2 | ||
| Location: DePaul Loop Campus -- Main Conference Venue, Daley Building, 14 E Jackson (Lower Level) | |||
| 08:00 | Registration opens | ||
| 09:00 | Welcome remarks | ||
| 09:15 | Keynote: Some Thoughts on the Challenges of the DFR Community by Eugene H. Spafford |
||
| Session Chair: Ibrahim Baggili, Louisiana State University, Baton Rouge | |||
| 10:30 | Break (30 minutes) | ||
| 11:00 | Paper Session 1: Memory Forensics (20 minutes per slot) | ||
| Session Chair: Nicole Beebe, Illinois Institute of Technology, Chicago | |||
| Memory Analysis of the Python Runtime Environment by Hala Ali, Andrew Case and Irfan Ahmed |
|||
| Detecting Hidden Kernel Modules in Memory Snapshots by Roland Nagy |
|||
| Leveraging Memory Forensics to Investigate and Detect Illegal 3D Printing Activities by Hala Ali, Andrew Case and Irfan Ahmed |
|||
| 12:00 | Lunch (1 hour and 30 minutes) | DePaul Center, 1 E Jackson Blvd (11th Floor) | |
| 13:30 | Paper Session 2: Artificial Intelligence and SoK (20 minutes per slot) | ||
| Session Chair: Cory Hall, Project VIC International | |||
| SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges by Frank Breitinger, Hudan Studiawan and Chris Hargreaves |
|||
| Bridging Knowledge Gaps in Digital Forensics using Unsupervised Explainable AI by Zainab Khalid, Farkhund Iqbal and Mohd Saqib |
|||
| Your Forensic AI-Asisstant, SERENA: Systematic Extraction and Reconstruction for ENhanced A2P Forensics by Jieon Kim, Byeongchan Jeong, Jungheum Park, Seungeun Park and Sangjin Lee |
|||
| 14:30 | Break (30 minutes) | ||
| 15:00 | Presentation Session (15 minutes + 5 minutes Q'n'A per slot) | ||
| Session Chair: Cheche Agada | |||
| DS2TX: Domain Specific Tree Traversal eXplainable Ai for Malicious Memory Dumps by Mohd Saqib, Farkhund Iqbal, Benjamin C. M. Fung and Zainab Khalid |
|||
| Agt Smith Escapes The Matrix: AI MultiAgents for Advanced Threat Detection by Jess Garcia |
|||
| Demonstration of Cyberattacks and Forensics on a Commercial Solar Inverter System by Bohyun Ahn, Hee-Yong Kwon and Taesic Kim |
|||
| 16:00 | Panel: The Mission Critical Role of Digital Forensics in Cybersecurity and Incident Response | Panel Members: TBD | |
| Panel Chair: Rami Salahieh |
|||
| 17:00 | Poster Presentation Introduction | ||
| 17:15 | Break (15 minutes) | ||
| 17:30 | Social activities: Welcome Reception and Poster Demo Session | DePaul Center, 1 E Jackson Blvd (11th Floor) | |
| End of day 2 | |||
| Thursday, July 24 | Day 3 | ||
| Location: DePaul Loop Campus -- Main Conference Venue, Daley Building, 14 E Jackson (Lower Level) | |||
| 08:30 | Registration opens | ||
| 09:00 | Administrative remarks | ||
| 09:15 | Keynote: New Approaches to High Technology Crime Scenes and Future Challenges by Steve DeBrota |
||
| Session Chair: Ibrahim Baggili | |||
| 10:30 | Break (30 minutes) | ||
| 11:00 | Paper Session 3: Database and OS Forensics (20 minutes per slot) | ||
| Session Chair: Wietse Venema | |||
| Uncovering Linux Desktop Espionage by Lukas Schmidt, Sebastian Strasda and Sebastian Schinzel |
|||
| Exploiting Database Storage for Data Exfiltration by James Wagner, Alexander Rasin and Vassil Roussev |
|||
| ANOC: Automated NoSQL Database Carver by Mahfuzul I. Nissan, James Wagner and Alexander Rasin |
|||
| 12:00 | Lunch (2 hours) DePaul Center, 1 E Jackson Blvd (11th Floor) | Birds of a Feather (2 hours) | |
| 14:00 | Paper Session 4: Approximate Matching (20 minutes per slot) | ||
| Session Chair: Bradley Schatz | |||
| If At First You Don't Succeed, Trie, Trie Again: Correcting TLSH Scalability Claims for Large-Dataset Malware Forensics by Jordi Gonzalez |
|||
| Bytewise Approximate Matching: Evaluating Common Scenarios for Executable Files by Carlo Jakobs, Axel Mahr, Martin Lambertz, Mariia Rybalka and Daniel Plohmann |
|||
| An Extensible and Scalable System for Hash Lookup and Approximate Similarity Search with Similarity Digest Algorithms by Daniel Huici, Ricardo J. Rodríguez and Eduardo Mena |
|||
| 15:00 | Poster Session (60 minutes) | ||
| 16:00 | Panel: Future Proof Forensics Forum - A glimpse at the next generation's bold ideas and ambitions (student panel) | Panel Members: TBD | |
| Panel Chair: Cory Hall, Project VIC International | |||
| 17:00 | Board of Directors update | ||
| 17:30 | Lightning Talks (3 minutes per talk) | ||
| 19:00 | Social activities: Awards Ceremony, Digital Forensics Rodeo & Dinner | The University Club -- 76 E Monroe St (Michigan Room) | |
| End of day 3 | |||
| Friday, July 25 | Day 4 | ||
| Location: DePaul Loop Campus -- Main Conference Venue, Daley Building, 14 E Jackson (Lower Level) | |||
| 08:30 | Registration opens | ||
| 09:00 | Paper Session 5: Selected Use Cases (20 minutes per slot) | ||
| Session Chair: Jay Wagner | |||
| Enhancing DFIR in Orchestration Environments: Real-time Forensic Framework with eBPF for Windows by Philgeun Jin, Namjun Kim and Doowon Jeong |
|||
| Forensic recovery via Chip-Transplantation in Samsung Smartphones by Sunbum Song, Gibum Kim, Hongseok Yang, Eunji Lee and Sangeun Lee |
|||
| Out of Control: Igniting SCADA Investigations with an HMI Forensics Framework and the Ignition Forensics Artifact Carving Tool (IFACT) by Lasean Salmon and Ibrahim Baggili |
|||
| Improved Bitcoin simulation model and address heuristic method by Yanan Gong, Kam Pui Chow and Siu Ming Yiu |
|||
| 10:20 | Break (40 minutes) | ||
| 11:00 | Presentation Session (20 minutes per slot) | ||
| Session Chair: Heng Yin | |||
| Investigating Program Activity using HeartSuite by Karen Heart |
|||
| 11:20 | Closing remarks | ||
| 12:00 | Lunch: Open Planning Session Planning lunch is open to anyone who wants to actively participate in DFRWS to discuss strategies for continuously improving DFRWS and to plan for the USA 2026 event and beyond. (Pay On your Own) | Lou Malnati's -- 805 S. State Street | |
| 14:00 | Social activities: DFRWS Expedition -- Architectural River Boat Tour ($45 optional add on) | River City Marina -- 900 South Wells St. BOARDING starts at 13:30. Please be at dock by 13:45 at the latest. The boat departs at 14:00 - sharp! |
|
| 15:30 | DFRWS Expedition ends | ||
| afterwards | Social activities: Unofficial GetTogether (on your own) |
||
| End of day 4 | |||
Full Paper Acceptance Rate
This year, there were 62 full papers submitted, with 16 being accepted after peer review – resulting in a full paper acceptance rate of 25.8%.