Please note: All times below are in Eastern Daylight Savings Time. For clarity, the current time in Baltimore, MD is:

Return to the USA 2023 Conference Page

Schedule of Events

Sunday, July 9
800Registration opens
Parallel session
845Ransomware Simulations: Hands-on Case Studies
by Ali Hadi and Mariam Khader (Champlain College)
Providing digital forensics as a service with code notebooks
by Harm van Beek (Netherlands Forensic Institute), Quintin Walters (MITRE) and Mattijs Ugen (Netherlands Forensic Institute)
1400Learning Linux Forensic Analysis and Why it Matters
by Ali Hadi and Mariam Khader (Champlain College)
Natural Language Processing (NLP) for Digital Forensics
by Mia Mohammad Imran, Hala Ali, Kostadin Damevski and Irfan Ahmed (Virginia Commonwealth University)
1815End of Day
Monday, July 10
830Registration opens
930Welcome remarks
945Keynote: Forensics in Outer Space - What to Find and Where to Find ItSamuel Sanders Visner, Technical Fellow, Aerospace Corporation
1115Paper Session: Memory Forensics
Session Chair: Irfan Ahmed
VIRTUALWindows Memory Forensics: Identification of (Malicious) Modifications in Memory-Mapped Image FilesFrank Block (Friedrich-Alexander University Erlangen-Nürnberg)
Database Memory Forensics: Identifying Cache Patterns for Log VerificationJames Wagner (University of New Orleans), Mahfuzul I. Nissan (University of New Orleans) and Alexander Rasin (DePaul University)
As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous ConsistencyJenny Ottmann, Üsame Cengiz (both Friedrich-Alexander University Erlangen-Nürnberg), Frank Breitinger (University of Lausanne) and Felix Freiling (Friedrich-Alexander University Erlangen-Nürnberg)
1345Paper Session: Network and Cloud Forensics
Session Chair: Aisha Ali-Gombe
Using Relational Graphs for Exploratory Analysis of Network Traffic DataMilan Cermak, Tatiana Fritzová, Vít Rusňák and Denisa Sramkova (Masaryk University)
PREE: Heuristic Builder for Reverse Engineering of Network Protocols in Industrial Control SystemsSyed Ali Qasim, Wooyeon Jo and Irfan Ahmed (Virginia Commonwealth University)
A Study on Cloud Data Access through Browser Credential Migration in Windows environmentUk Hur, Soojin Kang, Giyoon Kim, Jongsung Kim (Kookmin University)
1545Paper Session: IoT and Car Forensics
Session Chair: James Wagner
VIRTUALIoT Forensics: Analysis of a HIKVISION’s mobile appEvangelos Dragonas, Costas Lambrinoudakis (both University of Piraeus) and Michael Kotsis (University of West Attica)
Dashcam Forensic Investigation GuidelinesHarjinder Lallie (University of Warwick)
1645"Perspectives on Aerospace DFIR" Panel discussionSam
Visner (Aerospace Corporation), Tomas Pena (L3Harris), Nick
Tsamis (MITRE Corp.), and Joel Francis (Watch Center Leader at
1730Forensic Rodeo Prep Session
afterwards...Head out to the Brewery for the Welcome Reception
Welcome Reception & Poster / DemosPeabody Heights Brewery
401 E 30th St, Baltimore, MD 21218
Tuesday, July 11
930Administrative remarks
945Keynote: Revolutionizing Forensic Methodologies for the Next Space AgeTomas A. Pena, D.Sc., Lieutenant Colonel, USAF (Retired) (L3Harris)
1115Paper Session: Data, Datasets, and Sharing
Session Chair: Alex Nelson
Improving Trace Synthesis by Utilizing Computer Vision for User Action EmulationLukas Schmidt, Thomas Hupperich (both University of Münster) and Sebastian Kortmann (University of Amsterdam)
Expanding Digital Forensics Education with Artifact Curation and Scalable, Accessible Exercises via the Artifact Genome ProjectCinthya Grajeda, Jessica Berrios, Sankofa Benzo, Emmanuel Ogunwobi (all University of New Haven) and Ibrahim Baggili (Louisiana State University)
Sharing datasets for Digital Forensic: a novel taxonomy and legal concernsFrank Breitinger (University of Lausanne) and Alexandre Jotterand (id est avocats)
1245Lunch + Birds of Feather
1345Paper Session: Forensics and AI
Session Chair: Syed Ali Qasim
VIRTUALCombining AI and AM -- Improving Approximate Matching through Transformer NetworksFrieder Uhlig, Lukas Struppek, Dominik Hintersdorf (Technical University Darmstadt), Thomas Göbel, Harald Baier (Universität der Bundeswehr München) and Kristian Kersting (Technical University Darmstadt)
cRGB_Mem: At the Intersection of Memory Forensics and Machine LearningAisha Ali-Gombe, Sneha Sudhakaran (Louisiana State University), Ramyapandian Vijayakanthan (Towson University) and Golden Richard (Louisiana State University)
1445Break with Poster/Demo Session
1515Presentation Session
Session Chair: Adeen Ayub
The Remapped/Reallocated Sector Conundrum from a digital forensic investigation and data sanitation perspectivePhil Turner (ADISA)
The Quintilian Project - visualising reachable areasMatthew Sorell (Digital Forensic Sciences Australia Pty Ltd)
SaaS ForensicsEoghan Casey (OwnBackup)
1615Board of Directors update
1630Lightning Talks
1715Time on your own
1900The Gala Dinner-Awards Banquet and Forensics Rodeohosted at the Belvedere. (One East Chase St. Baltimore, MD21202 )
Wednesday, July 12
0930Administrative remarks
0945Paper Session: Mobile and Application Forensics
Session Chair: Wietse Venema
Every Step You Take, I'll be Tracking You: Forensic Analysis of the Tile Tracker ApplicationLauren Pace, Lasean Salmon, Christopher Bowen, Ibrahim Baggili and Golden Richard (Louisiana State University)
Factorizing 2FA: Forensic Analysis of Two-Factor Authentication ApplicationsJessica Berrios, Elias Mosher, Sankofa Benzo, Cinthya Grajeda (University of New Haven) and Ibrahim Baggili (Louisiana State University)
Systematic Evaluation of Forensic Data Acquisition using Smartphone Local BackupJulian Geus, Jenny Ottmann and Felix Freiling (Friedrich-Alexander University Erlangen-Nürnberg)
1115Forensic Challenge Announcement (Irfan Ahmed)
1130Closing remarks
1200Lunch: Open Planning SessionTamber Restaurant
3327 St Paul St, Baltimore, MD 21218

Planning lunch open to anyone who wants to actively participate in DFRWS to discuss strategies for continuously improving DFRWS and to plan for the USA 2024 event and beyond.
1345The Expedition will be held at the National Cryptologic Museum
1345Boarding begins for charter bus to National Cryptologic MuseumCHARTER BUS WILL Begin Boarding at 1:45
34th St. (in front of Wolman and McCoy Halls) (Attendees with personal transport may rendezvous with the group at the museum)
1400Bus departs Johns Hopkins University Commons
1430 -1630Tour - National Cryptologic Museum
1645Bus makes a pit stop at BWI Airport / MARC Amtrack station
1800DFRWS Expedition ends
1900Unofficial After Party (pay on your own)The Brewer's Art