Sunday, August 16, 2009
|4:00pm to 5:30pm
Monday, August 17, 2009
||Registration and Breakfast
Challenges and Opportunities in Digital and Multimedia Evidence
||SESSION 1: Tool testing and development
Chair: Wietse Venema
- Bringing Science to Digital Forensics with Standardized
Forensic Corpora. Simson Garfinkel, Paul Farrell, Vassil Roussev and George
* Best Paper Award *
verification of computer forensic software tools---Searching
Function. Yinghua Guo, Jill Slay and Jason Beckett. (paper)
DIALOG: A Framework for Modeling, Analysis and Reuse of Digital Forensic Knowledge.
Damir Kahvedzic and Tahar Kechadi. (paper)
||Lunch on your own
||SESSION 2: Large-scale investigations
Chair: Eoghan Casey
- A Second Generation Computer Forensic Analysis System. Daniel Ayers. (paper)
- Panel: Technical Approaches to Large-Scale Digital Forensics. Vassil Roussev, Golden Richard, Simson Garfinkel, and Michael Cohen.
||Presentation of the DFRWS 2009 Forensic Challenge Submissions
||Welcome Reception, Tool Demo, and Poster Session
Tuesday, August 18, 2009
Who are they? Understanding computer hackers.
||SESSION 3: Digital evidence storage and preservation
Chair: Frank Adelstein
- Teleporter: An Analytically and Forensically Sound Duplicate Transfer System.
Kathryn Watkins, Mike McWhorter, Jeff Long and William Hill. (paper)
- DEX: Digital Evidence Provenance Supporting Reproducibility and Comparison.
Brian N. Levine and Marc Liberatore. (paper)
- Extending the Advanced Forensic Format to accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow.
Michael Cohen, Simson Garfinkel and Bradley Schatz. (paper)
||Lunch on your own.
||SESSION 4: Event Reconstruction
Chair: Andreas Schuster
- Using ShellBag Information to Reconstruct User Activities.
Yuandong Zhu, Pavel Gladyshev and Joshua James. (paper)
- Computer Forensic Timeline Visualization Tool.
Jens Olsson and Martin Boldt. (paper)
||SESSION 5: File system analysis|
Chair: Golden Richard
- Identification and Recovery of JPEG Files with Missing Fragments.
Husrev Sencar and Nasir Memon. (paper)
- Digital Forensic Implications of ZFS.
Nicole Beebe, Sonia Mandes and Dane Stuckey. (paper)
- Lessons Learned from the Construction of a Korean Software Reference Data Set for Digital Forensics.
Kibom Kim, Sangseo Park, Taejoo Chang, Cheolwon Lee and Sungjai Baek. (paper)
Wrangler: Brian Carrier
Champions: Wietse Venema, Matthew Geiger, Tim Vidas, Judson Powers
Wednesday, August 19, 2009
||SESSION 6: Memory analysis and password recovery |
Chair: Vassil Roussev
- A Novel Time-Memory Trade-Off Method for Password Recovery.
Vrizlynn L. L. Thing and Hwei-Ming Ying. (paper)
- Extraction of Forensically Sensitive Information from Windows Physical Memory.
Seyed Mahmood Hejazi, Chamseddine Talhi and Mourad Debbabi. (paper)
- The Persistence of Memory: Forensic Identification and Extraction of Cryptographic Keys.
Carsten Maartmann-Moe, Andre Arnes and Steffen E. Thorkildsen. (paper)
||Short Presentations & Works in Progress|
Chair: Daryl Pfeif
(5 minutes each)
Lunch & DFRWS 2010 / 2011 Planning Session
(Not Included in