Sunday, August 16, 2009 |
|---|
| 4:00pm to 5:30pm |
Registration |
Monday, August 17, 2009 |
|---|
| 8:00am |
Registration and Breakfast |
| 9:00am |
Opening Remarks |
| 9:10am |
Keynote Address
Zeno Geradts
Challenges and Opportunities in Digital and Multimedia Evidence |
| 10:00am |
Break |
| 10:15am |
SESSION 1: Tool testing and development
Chair: Wietse Venema
- Bringing Science to Digital Forensics with Standardized
Forensic Corpora. Simson Garfinkel, Paul Farrell, Vassil Roussev and George
Dinolt. (paper)
* Best Paper Award *
-
Validation and
verification of computer forensic software tools---Searching
Function. Yinghua Guo, Jill Slay and Jason Beckett. (paper)
-
DIALOG: A Framework for Modeling, Analysis and Reuse of Digital Forensic Knowledge.
Damir Kahvedzic and Tahar Kechadi. (paper)
|
| 11:45am |
Lunch on your own |
| 1:45pm |
SESSION 2: Large-scale investigations
Chair: Eoghan Casey
- A Second Generation Computer Forensic Analysis System. Daniel Ayers. (paper)
- Panel: Technical Approaches to Large-Scale Digital Forensics. Vassil Roussev, Golden Richard, Simson Garfinkel, and Michael Cohen.
|
| 3:15pm |
Break |
| 3:30pm |
Presentation of the DFRWS 2009 Forensic Challenge Submissions |
| 5:00pm |
Welcome Reception, Tool Demo, and Poster Session |
Tuesday, August 18, 2009 |
|---|
| 8:00am |
Breakfast |
| 9:00am |
Administrative remarks |
| 9:05am |
Keynote Address
Benoît Gagnon
Who are they? Understanding computer hackers.
|
| 10:00am |
Break |
| 10:15am |
SESSION 3: Digital evidence storage and preservation
Chair: Frank Adelstein
- Teleporter: An Analytically and Forensically Sound Duplicate Transfer System.
Kathryn Watkins, Mike McWhorter, Jeff Long and William Hill. (paper)
- DEX: Digital Evidence Provenance Supporting Reproducibility and Comparison.
Brian N. Levine and Marc Liberatore. (paper)
- Extending the Advanced Forensic Format to accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow.
Michael Cohen, Simson Garfinkel and Bradley Schatz. (paper)
|
| 11:45am |
Lunch on your own. |
| 1:45pm |
SESSION 4: Event Reconstruction
Chair: Andreas Schuster
- Using ShellBag Information to Reconstruct User Activities.
Yuandong Zhu, Pavel Gladyshev and Joshua James. (paper)
- Computer Forensic Timeline Visualization Tool.
Jens Olsson and Martin Boldt. (paper)
|
| 2:45pm |
Break |
| 3:00pm |
SESSION 5: File system analysis
Chair: Golden Richard
- Identification and Recovery of JPEG Files with Missing Fragments.
Husrev Sencar and Nasir Memon. (paper)
- Digital Forensic Implications of ZFS.
Nicole Beebe, Sonia Mandes and Dane Stuckey. (paper)
- Lessons Learned from the Construction of a Korean Software Reference Data Set for Digital Forensics.
Kibom Kim, Sangseo Park, Taejoo Chang, Cheolwon Lee and Sungjai Baek. (paper)
|
| 6:00pm |
Banquet
|
| 7:30pm |
Forensic Rodeo |
Wednesday, August 19, 2009 |
|---|
| 8:00am |
Breakfast |
| 9:00am |
SESSION 6: Memory analysis and password recovery
Chair: Vassil Roussev
- A Novel Time-Memory Trade-Off Method for Password Recovery.
Vrizlynn L. L. Thing and Hwei-Ming Ying. (paper)
- Extraction of Forensically Sensitive Information from Windows Physical Memory.
Seyed Mahmood Hejazi, Chamseddine Talhi and Mourad Debbabi. (paper)
- The Persistence of Memory: Forensic Identification and Extraction of Cryptographic Keys.
Carsten Maartmann-Moe, Andre Arnes and Steffen E. Thorkildsen. (paper)
|
| 10:30am |
Break |
| 10:45am |
Short Presentations & Works in Progress
Chair: Daryl Pfeif
(5 minutes each) |
| 11:30am |
Closing Comments |
| 12:30pm |
Lunch & DFRWS 2010 / 2011 Planning Session
(Not Included in
Registration Fee)
|