After much discussion within the DFRWS EU organising committee, we are pleased to announce that we will be running the 2022 DFRWS EU conference as a hybrid event. This means that it will be possible for attendees and presenters to attend either physically in Oxford, UK, or virtually via Zoom.

This will be the first hybrid DFRWS conference and we are working to ensure a good experience for both attendance methods. For the physical event, we will be following the guidelines from the UK Government and Oxford University regarding coronavirus precautions. The conference will be held at the Mathematical Institute in the University of Oxford.

The event will include: Keynotes, Papers and Presentations, Hands-on Workshops, Poster and Demo Sessions, and more.

Register for either the virtual or physical event below.

Coronavirus Information

This will be the first DFRWS since the pandemic, and the first hybrid DFRWS event.

For the physical event, we will be following the guidelines from the UK Government and Oxford University regarding coronavirus precautions.

In addition, it is possible for either attendees and presenters to attend virtually, so no one should be excluded if they prefer not to attend a physical event at this time. If you are a presenter and you want to present virtually please contact the TPC chairs. If you are an attendee and you prefer to attend virtually, please select one of the virtual tickets in the registration section.

Conference Location:

The conference will be held at the Mathematical Institute in the University of Oxford and will be live streamed for online attendees.

March 29, 2022 to April 1, 2022

DFRWS EU 2022 dates are 29th March – April 1st*. However, the Women in Forensic Computing Workshop, is co-locating with DFRWS and will be held on Monday 28th March 2022, which requires a separate registration. 

*Please note that 1st April is reserved for the excursion to Bletchley Park which is included in your registration fee. Please reserve your place by selecting this option when you register. 

Travel Advice:

Please review this site for the most up-to-date Covid guidelines on travel to the UK. Please be sure to review the travel guidelines to/from for your individual country as well!  If you need to check if you need a visa to enter the UK, please see this site for more details.

Here you can find more information about how to travel to the city of Oxford.


Learning from previous years, we are unable to commit to block booking accommodation, given uncertain physical attendance numbers and ever-changing situations. As a result, you are encouraged to book your own accommodation. Some information is available below, but other travel websites will offer far more options than those provided below. Parking in Oxford can be difficult, so you are advised to check the options carefully if arriving by car.

Jurys Inn – 13 min bus to the conference venue, approximately every 15 mins.

Malmaison Oxford – 15 min walk to conference venue

Premier Inn – 17 min walk to conference venue

Easyhotel – 11min bus + walk to conference venue

University Rooms


Enterprise Forensics: Traditions vs Reality in modern DFIR

Emre Tınaztepe | Founder / CEO, Binalyze

Emre Tınaztepe is the founder and CEO of Binalyze, an Enterprise Forensics company headquartered in Estonia with offices in the US. He has a Bachelor’s degree in Systems Engineering. Emre has been into programming with a variety of languages for over 20 years with a strong background in Team Management, R&D, and Security Software Development. Being a lifetime learner, he has an insatiable desire to learn bits and bytes of low-level stuff such as operating system internals, the art of software development, and Digital Forensics and Incident Response. Prior to starting Binalyze, Emre worked in a variety of positions in global Cyber Security companies. His areas of expertise include Reverse Engineering, Malware Analysis, Driver Development, and Incident Response. He also lead the development of an Anti-Malware suite which is used by millions of users for protecting their devices against cyber attacks. He is actively participating in the development of next-generation Digital Forensics solutions with Binalyze's world-class team and evangelizing the Enterprise Forensics category.

Keynote Abstract:

Digital Forensics is 40-years old, so are the methods. Cyber attacks are happening every second while we are waiting for hours to complete for a disk duplicator to finish. A single disk from a single workstation that will be investigated by a single investigator. Is it the correct way of doing forensics in 2022? Should we keep using the traditional methods or find alternative solutions? If yes, where is the line? In this talk, we will be discussing the history of Digital Forensics and try to understand it better so that both strengths and weaknesses are highlighted. Then we will introduce the next era of digital forensics that is now called Enterprise Forensics.

Global Incident Response

Serge Droz | Director, Board Forum of Incident Response and Security Teams (FIRST)

Serge Droz is a senior IT-Security expert and seasoned incident responder. Serge is currently moving from his job as head of security at Proton to a new challenge as a Senior advisor in the newly created Department of Digitalisation at the Swiss department of foreign affairs focusing on cybersecurity.

In his former life he studied physics at ETH Zurich and the University of Alberta, Canada and holds a PhD in theoretical astrophysics. He has worked in private industry and academia in Switzerland and Canada in different security roles, at a national CERT in Switzerland for more than 20 years.

Serge is a member of the board of directors of FIRST (Forum for Incident Response and Security Teams), the premier organisation of recognised global leaders in incident response. In this role he actively participates in discussion relating to cyber security at various policy bodies, in particular related to norm building. Serge is an active speaker and a regular trainer for CSIRT (Computer Security Incident Response Team) courses around the world.

Keynote Abstract:

Security incidents happen, and they seem to get bigger: Yet the internet does not stop. In fact the internet keeps growing and providing a positive impact to an ever increasing number of people.

The reason that the internet has not become a crime ridden place people avoid has two main reasons: Tech companies have invested a lot in making their products more secure. At the same time incident responders have been working quietly over the years to make sure the internet stays safe for users. The success of this is not obvious in an environment like the internet with thousands of independent participants.

Today it seems incident response is more affected by political issues than by technical challenges. We will look at how incident responders work together globally, what challenges they face and they need to be successful in the future.


DFRWS invites contributions in the categories listed below. We ask to submit all contributions via EasyChair ( and follow the submission guidelines (

FULL RESEARCH PAPERS undergo double-blinded peer review, and the proceedings are published by Elsevier as a special issue of the Journal of Forensic Science International: Digital Investigation. We ask to submit articles according to the submission instructions.

PRESENTATIONS / DEMOS require a brief proposal (~500 words, informal), not a paper. These proposals undergo a light review process to select presentations of maximal interest to DFRWS attendees, and to filter out sales pitches. Accepted proposals will be given a presentation slot (~15min) during the conference. These proposals must be submitted through EasyChair. Note that the presentation/demo will not be part of the published proceedings.

POSTERS This year’s conference will have a physical poster session. The posters will be exhibited during the whole conference, with a dedicated poster session during a break where poster authors will be available by their posters. For our online audience, the posters will be available on the conference webpage together with contact details such that online participants can communicate questions or comments to the authors. In addition, the poster authors are encouraged to sign up for a lightning talk to present their work.

The poster must:

  • Not exceed A0 size (841 mm x 1189 mm)
  • Be readable both printed and on-screen
  • Be of interest to the digital forensic community
  • Not be a sales pitch or advertisement

The poster layout is up to the authors to decide.

The posters are not included in the conference proceedings and will not be subject to a peer-review process. However, they will get a short audit before being exhibited to ensure they follow the above requirements.

Authors can submit posters to for approval. The approval process typically takes 1-2 days. Please make sure that you submit early enough to have time for printing the posters after approval. Minor changes to the contents are accepted without a new audit, such as improving the quality of illustrations, correcting spelling or other errors, etc. However, authors should send the final version to the same email address before the conference begins to be exhibited online.

WORKSHOPS / TUTORIALS can be 2 to 4 hours (please indicate) and typically include hands-on participation by attendees, allowing for an in-depth, detailed exploration of tools and techniques of interest to DFRWS attendees. Workshops can cover state-of-the-art research projects, useful tips and techniques for standard tools, or most anything that DFRWS attendees would consider beneficial. While commercial tools can be used, these workshops or tutorials should NOT be thinly-veiled commercial advertisements. DFRWS will provide one free conference registration for each workshop accepted.

PANEL PROPOSALS should be one to three pages and clearly describe the topic, its relevance, and a list of potential panelists including their biographies (short). Panels will be evaluated based on the topic relevance and diversity of the panelists.

Submission Information

Paper submissions must be submitted through the EasyChair site at Submissions must be in PDF format and follow the submission criteria and guidelines ( ). Organizers may reject work that does not follow the listed criteria.

Proposals for workshops must be emailed to eu-workshops <at> dfrws <dot> org in PDF or plain-text format and must include information about the delivery formats possible: Physical workshop only/online workshop only/hybrid delivery possible. Sample workshop proposal template available here:

Proposals for panels, presentations and demos must be emailed to eu-paper <at> dfrws <dot> org.


Contact Information

For questions related to paper, presentation, and demo submissions, please send email to: eu-papers <at> dfrws <dot> org

For questions about workshop/tutorial proposals, please send email to: eu-workshops <at> dfrws <dot> org

For questions related to presenting a poster at DFRWS EU 2022 please send email to: eu-posters <at> dfrws <dot> org

For questions related to the organisation of DFRWS EU 2022 please send email to: eu <at> dfrws <dot> org

Student Scholarship and Award Program

DFRWS continues its outreach to students studying digital forensics. DFRWS and its sponsors will award one or more Scholarships each year to students (first author) who present their accepted research papers. One scholarship will be awarded to the Best Student Research Paper awardee. More scholarships may be awarded, depending on sponsorship funding each year. Exact award amounts will vary, but usually cover at least registration expenses. DFRWS will notify the recipient of the Best Student Research Paper award on or before the conference registration deadline. Other awards (e.g. industry sponsored awards for research in specific topic areas) may be awarded after the registration deadline and are fully contingent on scholarship sponsorship by industry each year. Refer to the website for further details regarding eligibility, funding and selection (Student Scholarship & Award Program).

Topics of Interest

DFRWS welcomes new perspectives that push the envelope of what is currently possible in digital forensics. Potential topics (alphabetical) to be addressed by submissions include any digital forensic related topic, for example (but not limited to):

  • Anti-forensics and anti-anti-forensics
  • Case studies and trend reports
  • Cloud and virtualized environments
  • Covert channels (e.g., TOR, VPN)
  • Digital evidence sharing and exchange
  • Digital evidence and the law
  • Digital forensic preparedness / readiness
  • Digital investigation case management
  • Digital forensic tool validation
  • Digital forensic triage / survey
  • Event reconstruction methods and tools
  • Forensics analysis and visualization of Big Data
  • Implanted medical devices
  • Machine learning and data mining for digital evidence extraction/query
  • Malware and targeted attacks (analysis and attribution)
  • Mobile and embedded device forensics
  • Network and distributed system forensics
  • Non-traditional forensic scenarios / contexts
  • SCADA / industrial control systems
  • Smart power grid forensics
  • Smart building forensics
  • Vehicle forensics (e.g., drones, cars)
  • Virtual currency

Click Here For Proposal Requirements


October 15, 2021 *EXTENDED* Paper Submission Deadline
November 20, 2021 Notification of Acceptance
December 4, 2021 Camera Ready Submission and Presenter Registration
February 11, 2022 *EXTENDED* Panel Proposals, Workshop / Tutorial and Presentations / Demos deadline:
March 25, 2022 Poster Submission Deadline


Organizing Committee

Conference Co-Chair

Chris Hargreaves, Ph.D. (University of Oxford)

Conference Co-Chair

Felix Freiling, Ph.D. (Friedrich-Alexander-Universität Erlangen-Nürnberg)

Program Chair

John Sheppard, Ph.D. (Waterford Institute of Technology)

Program Vice Chair

Christian Riess (Friedrich-Alexander-Universität Erlangen-Nürnberg)

Chief Organizational Officer

Daryl Pfeif (Digital Forensics Solutions and DFRWS)

Workshop Chair

Mark Scanlon, Ph.D. (University College Dublin)

Forensic Challenge Chair

Eoghan Casey, Ph.D. (University of Lausanne)

Proceedings Chair

Jan-Niclas Hilgert (Fraunhofer FKIE)

Proceedings Vice Chair

Edita Bajramovic (Siemens Energy)

Poster Chair

Jens-Petter Sandvik (Norwegian University of Technology and Science)

Poster Vice Chair

Aikaterini Kanta (University College Dublin)

Web Co-Chair

Holger Morgenstern (Albstadt-Sigmaringen University)

Web Co-Chair

Maike Raphael (Friedrich-Alexander-Universität Erlangen-Nürnberg​)

Social Media Chair

Aikaterini Kanta (University College Dublin)

Keynote Co-Chair

Hans Henseler, Ph.D. (University of Applied Sciences Leiden_

Keynote Co-Chair

Frank Breitinger, Ph.D (University of Lausanne)

Keynote Co-Chair

Bruce Nikkel, Ph.D. (BFH)

Birds of a Feather Chair

Frank Adelstein, Ph.D. (NFA Digital)

Birds of a Feather Vice Chair

Graeme Horsman, Ph.D. (Teeside University)

On-site Support

Lena Voigt (Friedrich-Alexander-Universität Erlangen-Nürnberg​)

On-site Support

Immanuel Lautner (Friedrich-Alexander-Universität Erlangen-Nürnberg​)

On-site Support

Aikaterini Kanta (University College Dublin)

On-site Support

MRusyaidi Bin Zunaidi (University College Dublin)

On-site Support

Maike Raphael (Friedrich-Alexander-Universität Erlangen-Nürnberg​)

On-site Support

Freddie Barr-Smith (University of Oxford)

On-site Support

Edward Salkield (University of Oxford)

Virtual Support

Mariya Shafat (University of Kashmir)

Technical Program Committee

Frank Adelstein, Ph.D.

NFA Digital

Irfan Ahmed

Virginia Commonwealth University

Saed Alrabaee

United Arab Emirates University

Olga Angelopoulou, Ph.D.

University of Warwick

Cosimo Anglano

Universitá del Piemonte Orientale

Harald Baier, Ph.D.

Universität der Bundeswehr München

Elias Bou-Harb, Ph.D.

University of Texas at San Antonio

Owen Brady, Ph.D.

King's College London

Frank Breitinger, Ph.D.

University of Liechtenstein

Patrick De Smet, Ph.D.


Mattia Epifani


Virginia Franqueira

University of Kent

Felix Freiling, Ph.D.

Friedrich-Alexander-Universität Erlangen-Nürnberg

Zeno Geradts, Ph.D.

Netherlands Forensic Institute

Oliver Goebel

University of Stuttgart

Chris Hargreaves, Ph.D.

University of Oxford

Hans Henseler, Ph.D.

University of Applied Sciences Leiden

Mario Hildebrandt

Otto-von-Guericke University of Magdeburg

Jan-Niclas Hilgert


Joshua James, Ph.D.

Hallym University

David-Olivier Jaquet-Chiffelle, Ph.D.

University of Lausanne

Michael Johnson

Self Employed

Erisa Karafili

University of Southampton

Christian Keil, Ph.D.


Stefan Kiltz

Universität Magdeburg

Christian Kraetzer, Ph.D.

Otto-von-Guericke University Magdeburg

Martin Lambertz

Fraunhofer FKIE

Hanno Langweg, Ph.D.

HTWG Konstanz

David Lillis, Ph.D.

University College Dublin

Holger Morgenstern

Albstadt-Sigmaringen University

Tilo Müller

Hof University of Applied Sciences

Bruce Nikkel, Ph.D.

Bern University of Applied Sciences

Owen O'Connor


Gilbert Peterson, Ph.D.

US Air Force Institute of Technology

Daryl Pfeif


Christian Riess, Ph.D.

University of Erlangen-Nuremberg

Ricardo J. Rodríguez

Universidad de Zaragoza

Mark Scanlon, Ph.D.

University College Dublin

Bradley Schatz, Ph.D.

Schatz Forensic

Tobias Scheible

Albstadt-Sigmaringen University

Thomas Schreck, Ph.D.

University of Applied Sciences Munich

Marko Schuba, Ph.D.

FH Aachen - Aachen University of Applied Sciences

Andreas Schuster

DCSO Deutsche Cyber-Sicherheitsorganisation GmbH

John Sheppard, Ph.D.

Waterford Institute of Technology

Michael Spreitzenbarth, Ph.D.

Siemens CERT

Marian Svetlik

Risk Analysis Consultants

Harm Van Beek

Netherlands Forensic Institute

Jeroen van den Bos, Ph.D.

Netherlands Forensic Institute

Ronald van der Knijff

Netherlands Forensic Institute

Erwin van Eijk

Netherlands Forensic Institute

Wietse Venema, Ph.D.


Claus Vielhauer, Ph.D.

FH Brandenburg

Xiaolu Zhang

The University of Texas at San Antonio


Register Now

Register Now


Sponsors help DFRWS to produce quality events and foster community. Click a logo to learn more about the sponsor.

Information about sponsorship opportunities is available at:

Magnet Forensics

Magnet Forensics is a global leader in digital investigative technology and was built on a foundation of helping and empowerment. We help investigative teams find more evidence and empower them to uncover the truth. Our products are designed to leverage the latest technological innovations to help law enforcement, consultants, military, and private enterprise address these issues. We use AI, automation, advanced searching techniques, modern data visualization and more to help investigative teams find digital evidence and understand the story it is telling.

Learn More

Forensic Focus

Forensic Focus is the web's leading digital forensics portal for computer forensics and eDiscovery professionals. Founded in July 2002, the site quickly developed a reputation for encouraging open discussion and information sharing in support of best practice development within the digital forensics industry. Although perhaps best known for its busy forums, Forensic Focus also offers breaking industry news, a worldwide directory of computer forensics education courses, interviews with industry thought leaders, job vacancy listings, a growing articles section and a monthly email newsletter with over 16,000 subscribers. For those looking to expand their professional network, Forensic Focus runs LinkedIn's largest digital forensics group.

Learn More


Learn More

DeSales University

Online Master of Criminal Justice: Digital Forensics

Learn More


Grayshift is the leader in mobile device digital forensics, specializing in lawful access and extraction. Grayshift’s innovative solutions are purpose-built to help law enforcement and government investigative agencies swiftly resolve critical investigations and ensure public safety. Designed and assembled in the United States, the company’s GrayKey technology provides same-day access, complete control, and comprehensive data extraction from mobile devices. Powered by the Grayshift advanced security research team, GrayKey exemplifies the company’s promise of innovation and mission to deliver solutions that safeguard the public. Delivering world-class customer success, Grayshift is trusted by 1000 agencies across more than 25 countries worldwide.

Learn More

Bern University of Applied Sciences

The Bern University of Applied Sciences offers Bachelor and Master level education in Digital Forensics & Cyber Investigation ( and in Cyber Security. The security research institute conducts research and development in areas of digital forensics, cyber security, E-Voting, privacy, and secure IoT.

Learn More


Compelson, in the forensics field since 1996, will present their new generation tools. The all-in-one MOBILedit Forensic Express is capable of a wide range of deleted data recovery, advanced application data analysis, multiple-device concurrent extractions, beautiful reports and huge phone base support. Free on-demand application analysis will be introduced. Also to be presented is the pioneering digital photo analysis tool, Camera Ballistics, that matches a photo to a camera or phone, like a bullet to a gun answering the question if a photo was taken by an analyzed device. The tool uses the latest research in mathematics and physics.

Learn More


Qintel is the industry leader for cyber threat intelligence and investigations. Founded in 2009, Qintel provides its partners unique insight into cyber threats and adversarial behavior. Qintel's capabilities are driven by proprietary technologies and unparalleled access to data sources across the globe. These resources are leveraged by a staff of veteran researchers and technologists who have decades of experience analyzing and pursuing cyber threats that span the spectrum of online activity.

Learn More


As encrypted devices like smartphones, USB memory sticks and connected car is a growing topic in the digital forensic communities, the need for professional security consulting and professional tooling for hardware analysis is growing. Riscure can support with tools, training and device security services. Riscure is a leading security test tools manufacturer and security test lab since 2001. The objective is to enable forensic laboratories to develop capabilities and knowledge to perform digital forensic tasks as well as provide technical experts that can extract data from encrypted devices

Learn More


Evimetry is a system for accelerating workflow at the front end of forensic processes, encompassing acquisition, live analysis, triage, and remote forensics.

Learn More