DFRWS 2016 EU Agenda

The DFRWS 2016 EU Agenda below summarizes the program of discussion and research. This years conference is held in cooperation with the Association for Computing Machinery (ACM) and its Special Interest Group on Security, Audit and Control (SIGSAC).

This is a preliminary program that will be updated as workshops, keynotes and the technical program details are finalized.

Tuesday 29 March 2016 - Pre-Conference Workshops

Amphimax, UNIL-Sorge, University of Lausanne
8:00 Registration opens (Amphimax, UNIL-Sorge, University of Lausanne)
08:50 Announcements
  Workshop Track 1
(Amphimax Auditorium 351)
Workshop Track 2
(Amphimax 410)
Workshop Track 3
(Amphimax 415)
Sponsored Track
(Amphimax 414)
09:00 Virtual currencies
André Fischer, Jakob Hasse & Thomas Gloe (dence GmhH, Germany)
Fun with the beast: Traffic Mining (TM) using Brain and Tranalyzer. Part 1: Fundamentals of traffic mining.
Stefan Burschka (RUAG)
10:30 Break (Coffee and Tea)
11:00 Virtual currencies.(cont)
André Fischer, Jakob Hasse & Thomas Gloe (dence GmhH, Germany)
Fun with the beast: Traffic Mining (TM) using Brain and Tranalyzer. Part 1: Fundamentals of traffic mining.(cont)
Stefan Burschka (RUAG)
12:30 Lunch (Amphimax Restaurant)
13:30 Evidence Exchange between Courts in Europe: a standard proposal to be discussed.
M.A. Biasiotti, M. Epifani, F. Turchi, and J. C. Deprez, N. Matskanis
Plaso Parser Workshop
Daniel White (Google)
Fun with the beast: Traffic Mining (TM) using Brain and Tranalyzer. Part 2: Using Tranalyzer
Stefan Burschka (RUAG)
Sponsored tutorial: Analysis of deleted data
Roman Locher (Arina AG)
15:00 Break (Coffee and Tea)
15:30 Evidence Exchange between Courts in Europe: a standard proposal to be discussed.(cont)
M.A. Biasiotti, M. Epifani, F. Turchi, and J. C. Deprez, N. Matskanis
Plaso Parser Workshop. (cont)
Daniel White (Google)
Fun with the beast: Traffic Mining (TM) using Brain and Tranalyzer. Part 2: Using Tranalyzer. (cont)
Stefan Burschka (RUAG)
Sponsored tutorial: Windows Event Log analysis: Gathering great information the easy way!
Roman Locher (Arina AG)
18:00 Social Event: Guided tour of the Olympic Museum (Meet no later than 17:55 at the museum entrance; doors will be closed at 18:00!)

Wednesday, 30 March 2016 - Main Conference

Amphimax, Auditorium 351, University of Lausanne
08:00 Registration opens (Amphimax, UNIL-Sorge, University of Lausanne)
08:40 Opening Remarks / Official Welcome
09:00 Keynote Address: The Long and Winding Road to Digital/Multimedia Science
Eoghan Casey & David-Olivier Jaquet-Chiffelle
10:00 Break (Coffee and Tea)
10:30 SESSION 1: Memory Forensics I
Chair: Vassil Roussev
  • Evaluating Atomicity, and Integrity of Correct Memory Acquisition Methods ( paper | pres )
    Michael Gruhn and Felix Freiling
  • Automatic Profile generation for live Linux Memory analysis ( paper | pres )
    Michael Cohen and Arkadiusz Socala
  • Pool Tag Quick Scanning for Windows Memory Analysis ( paper | pres )
    Joe Sylve, Vico Marziale and Golden Richard
12:00 Lunch (Amphimax Restaurant)
13:30 SESSION 2: Technology-specific Analysis
Chair: Robert Jan Mora
  • A Scalable Authorship Verification Method for Different Languages, Genres and Topics ( paper | pres )
    Oren Halvani, Christian Winter and Anika Pflug
  • Generic RAID Reassembly using Block-Level Entropy ( paper | pres )
    Christian Zoubek, Sabine Seufert and Andreas Dewald
14:30 Break (Coffee and Tea)
15:00 SESSION 3: Short Presentations 1
Chair: Maria Angela Biasiotti
  • Studying the structure and organisation of illicit drugs trafficking on Darknet markets through the analysis of digital, chemical and physical traces. ( pres )
    Damien Rhumorbarbe, Ludovic Staehli, Julian Broséus, Quentin Rossy and Pierre Esseiva
  • Internet forums: a source of intelligence to monitor the online diffusion of doping products ( pres )
    Thomas Pineau, Adrien Schopfer, Lionel Grossrieder, Pierre Esseiva and Quentin Rossy
  • Discovering Windows Phone 8 artifacts and secrets ( pres )
    Mattia Epifani, Francesco Picasso and Marco Scarito
16:00 SESSION 4: Data Acquisition
Chair: Eoghan Casey
  • A method and a case study for the selection of the best available tool for mobile device forensics using decision analysis ( paper | pres )
    Shahzad Saleem, Oliver Popov and Ibrahim Baggili
  • Lest We Forget: Cold-Boot Attacks on Scrambled DDR3 Memory ( paper | pres )
    Johannes Bauer, Michael Gruhn and Felix Freiling
19:30 Social Event: Gala dinner, forensic rodeo, & best paper awards (included in the registration fee)
Starling Hotel Lausanne, UNIL-EPFL campus

Thursday, 31 March 2016 - Main Conference

Amphimax, Auditorium 351, University of Lausanne
08:00 Registration opens (Amphimax, UNIL-Sorge, University of Lausanne)
08:50 Announcements
09:00 Keynote Address: Challenges in Big Multimedia Forensics, From Drones to Virtual Reality and Evidence in Court
Mr. Zeno Geradts
10:00 Posters and Break (Coffee and Tea)
10:15 SESSION 5: Handling Digital Evidence
Chair: Hans Henseler
  • Tiered Forensic Methodology Model for Digital Field Triage by Non-Digital Evidence Specialists ( paper | pres )
    Ben Hitchcock, Nhien An Le Khac and Mark Scanlon
  • Digital evidence, 'absence' of data and ambiguous patterns of reasoning ( paper | pres )
    Alex Biedermann and Joëlle Vuille
  • Forensic Investigation of Cyberstalking Cases using Behavioural Evidence Analysis ( paper | pres )
    Noora Al Mutawa, Joanne Bryce, Virginia N. L. Franqueira and Andrew Marrington
12:00 Lunch (Amphimax Restaurant)
13:00 SESSION 6: Short Presentations 2
Chair: Bruce Nikkel
  • The Digital Evidence Dashboard Project ( pres )
    Hans Henseler and Adrie Stander
  • Study and analysis of Orweb anonymizer on Android devices ( pres )
    Claudia Meda and Mattia Epifani
  • Life on Clouds, a forensics overview ( pres )
    Marco Scarito, Mattia Epifani and Francesco Picasso
14:00 Lightning Talks (signup at registration desk on-site)
14:30 Posters and Break (Coffee and Tea)
15:00 SESSION 7: Cloud and Networks
Chair: Mark Scanlon
  • Forensic Analysis of Cloud-native Artifacts ( paper | pres )
    Vassil Roussev and Shane McCulley
  • TLSkex: Harnessing virtual machine introspection for decrypting TLS communication ( paper | pres )
    Benjamin Taubmann, Christoph Fr├Ądrich, Dominik Dusold and Hans P. Reiser
  • Facilitating Forensic Examinations of Multi-User Computer Environments through Session-to-Session Analysis of Internet History ( paper | pres )
    David Gresty, Diane Gan, George Loukas and Constantinos Ierotheou
16:30 Panel Discussion
Title: Conclusions Scales or Likelihood Ratios in Digital Forensic Science
Moderator: Eoghan Casey
  • Zeno Geradts
  • Alex Biedermann
  • Franco Taroni
  • Christophe Champod
17:30 Closing Remarks / Announcements

©2001-2016 DFRWS   |   dfrws [at] dfrws [dot] org  

DFRWS is a US 501(c)(3) non-profit organization.