Wednesday, March 21, 2018
Loggia Room Bargello Room Franciabigio Room Pitti
8:30 to 9:30


9:30 to 12:30

Image and Video Forensics: Enhancement and Analysis Workshop

Sebastiano Battiato (University of Catania) Martino Jerian (Amped Software)

Where Did That Incriminating Evidence Come From? Workshop

Martin Westman (MSAB)

iOS Physical Acquisition Workflow: From Jailbreaking to Extraction Workshop

Oleg Afonin (Elcomsoft) Vladimir Katalov (ElcomSoft)
11:00 to 11:15


12:30 to 14:00

Lunch (on site)

14:00 to 17:00

Image and Video Forensics: Fundamentals on Image Source Identification and Authenticity Verification Workshop

Roberto Caldelli (MICC at University of Florence) Irene Amerini (MICC at University of Florence)

CASE Technical Implementation Workshop Workshop

Eoghan Casey, Ph.D. (University of Lausanne) Ryan Griffith (DC3) Harm van Beek (Netherlands Forensic Institute) Erwin van Eijk (Netherlands Forensic Institute) Jared Stroud (MITRE)

Advanced Acquisition & Analysis with the AFF4 Workshop

Bradley Schatz, Ph.D. (Schatz Forensic)
15:30 to 15:45


17:00 to 19:00

Welcome Reception (w/ Concert & Demos)

Thursday, March 22, 2018
Loggia Pontevecchio Hall
8:00 to 9:00


9:00 to 9:15

Welcome / Announcements

Florence Vice-Mayor Dr. Cristina Giachi will extend greetings

9:15 to 10:15

Keynote Address

10:15 to 10:30

Break / Networking / Posters

10:30 to 12:00

Session I - Knowledge and Education

Mariangela Biasiotti (Italian National Research Council)

Educating Judges, Prosecutors and Lawyers  in the Use of Digital Forensic Experts Paper

Hans Henseler, Ph.D. (University of Applied Sciences Leiden) Sophie Van Loenhout

A Comparative Study on Data Protection Legislations and Government Standards to Implement Digital Forensic Readiness as Legal Requirement Paper

Sungmi Park (KITRI BoB) Nikolay Akatyev (Horangi Cyber Security) Donghyun Kim (KITRI BoB) Jisoo Hwang (KITRI BoB) Woonseon Yoo (KITRI BoB) Hyunwoo Shin (KITRI BoB) Changhee Han (KITRI BoB) Kim Jong Hyun (Douzone Forensic Center) Yunsik Jake Jang (Hallym University)

Nugget: A Digital Forensics Language Paper

Christopher Stelly (University of New Orleans) Vassil Roussev, Ph.D. (University of New Orleans)
12:00 to 13:00

Lunch (on site)

13:00 to 14:30

Session II - Evidence Analysis

Mattia Epifani (ITTIG - CNR)

Building Stack Traces From Memory Dump of Windows x64 Paper

Yuto Otsuki (NTT) Yuhei Kawakoya (NTT) Makoto Iwamura (NTT) Jun Miyoshi (NTT) Kazuhiko Ohkubo (NTT)

Forensics Acquisition - Analysis and Circumvention of Samsung Secure Boot Enforced Common Criteria Mode Paper

Gunnar Alendal (NTNU) Geir Olav Dyrkolbotn (NTNU) Stefan Axelsson (Norwegian University of Science and Technology)

OpenForensics: A Digital Forensics GPU Pattern Matching Approach for the 21st Century Paper

Ethan Bayne (Abertay University) Ian Ferguson (Abertay University) Adam Sampson (Abertay University)
14:30 to 15:00

Break / Networking / Posters

15:00 to 16:30

Session III - Digital Evidence

Bruce Nikkel, Ph.D. (Bern University of Applied Sciences)

A Standardized Corpus for SQLite Database Forensics Paper

Sven Schmitt (Friedrich-Alexander-University) Felix Freiling (Friedrich-Alexander-University) Sebastian Nemetz (Friedrich-Alexander-University)

The Reliability of Clocks as Digital Evidence Under Low Voltage Conditions Paper

Jens-Petter Sandvik (Norwegian University of Technology and Science) André Årnes (Norwegian University of Technology and Science)

Using Computed Similarity of Distinctive Digital Traces to Evaluate Non-obvious Links and Repetitions in Cyber-investigations Paper

Timothy Bollé (University of Lausanne) Eoghan Casey, Ph.D. (University of Lausanne)
16:30 to 16:45


Daryl Pfeif (Digital Forensics Solutions and DFRWS)
17:00 to 18:30

Break to allow time for Attendees to proceed to OFFSITE Banquet Venue VILLA CORA

(venue is 10-15 min walk from Conference)
Group transportation not provided
VILLA CORA address:
Viale Machiavelli 18, 50125 Firenze
Tel: +39 055 22 87 90
18:30 to 21:30

DFRWS Banquet / Awards Ceremony (@ VILLA CORA)

The year's Banquet is sponsored by ITTIG

21:30 to 23:00

Forensics Rodeo

This year's rodeo was developed by Mattia Epifani
(REALITY NET System Solutions Snc)
All participants are encouraged to participate in the Forensics Rodeo - A friendly, but fierce, capture the flag style forensics competition. Be Prepared - Bring your laptop and favorite forensics tools to win prizes and glory!
Friday, March 23, 2018
Loggia Pontevecchio Hall
8:00 to 9:00


9:00 to 10:00

Keynote Address

10:00 to 10:30

Break / Networking / Posters

10:30 to 12:00

Session IV - Automation

Mark Scanlon, Ph.D. (University College Dublin)

MalDozer: Automatic Framework for Android Malware Chasing Using Deep Learning Paper

ElMouatez Billah Karbab (Concordia University) Mourad Debbabi (Concordia University) Abdelouahid Derhab (King Saud University) Djedjiga Mouheb (University of Sharjah)

Forensic Framework to Identify Local vs Synced Artifacts Paper

Jacques Boucher Nhien An Le Khac (University College Dublin)

Data-Driven Approach for Automatic Telephony Threat Analysis and Campaign Detection Paper

Houssem Eddine Bordjiba (Concordia University) ElMouatez Billah Karbab (Concordia University) Mourad Debbabi (Concordia University)
12:00 to 13:00

Lunch (on site)

13:00 to 14:30

Session V - Anti-Forensics

Hans Henseler, Ph.D. (University of Applied Sciences Leiden)

Controlled Experiments in Digital Evidence Tampering Paper

Felix Freiling (Friedrich-Alexander-University) Leonhard Hösch (Friedrich-Alexander-University)

Anti-Forensics in ext4: On Secrecy and Usability of Timestamp-Based Data Hiding Paper

Thomas Göbel (University of Applied Sciences, Darmstadt) Harald Baier (University of Applied Sciences, Darmstadt)

Styx: Countering Robust Memory Acquisition Paper

Ralph Palutke (Friedrich-Alexander-University) Felix Freiling (Friedrich-Alexander-University)
14:30 to 15:00

Break / Networking / Posters

15:00 to 16:00


Babak Habibnia (University College Dublin)

Obtaining Critical Real-Time Evidence From the Cloud Presentation

Vladimir Katalov (ElcomSoft)

Decision-Theoretic File Carver for Triage Situations Presentation

Pavel Gladyshev, Ph.D. (University College Dublin)

Forensicating the Apple TV Presentation

Mattia Epifani (ITTIG - CNR) Claudia Meda (REALITY NET System Solutions Snc)
16:00 to 16:15

Closing Comments

18:00 to 21:00


Add to My Calendar

iCal Feed

Please click the button to subscribe to the iCal feed for this Conference.