| 7:30 |
Registration and Breakfast |
| 8:30 |
Welcome and Conference Overview |
| 8:40 |
Autopsy 3.0
Brian Carrier (slides) |
| 9:15 |
Analyzing Volume Shadow Snapshots (VSS) without Using Windows
Joachim Metz (slides) |
| 9:50 |
Advanced Registry Forensics with Registry Decoder
Dr. Lodovico Marziale (slides) |
| 10:25 |
Break |
| 10:40 |
Automated Forensics with the Sleuth Kit Framework
Eamonn Saunders (slides) |
| 11:15 |
Forensic Scanner
Harlan Carvey (slides) |
| 11:50 |
Lunch |
| 13:00 |
Cross-Drive Analysis with Bulk_Extractor and CDA Tool
Simson Garfinkel (slides) |
YAFFS2 Support for The Sleuth Kit
Andrew Hoog viaForensics (slides) |
| 13:35 |
Break |
| 13:40 |
GRR Rapid Response
Darren Bilby (slides) |
Using and Developing with Open Source Forensics Software in Digital Archives Programs
Mark Matienzo (slides) |
| 14:15 |
Break |
| 14:20 |
The Sleuth Kit & Apache Hadoop
Jon Stewart (slides) |
RubyTSK: Ruby Bindings for The Sleuth Kit
Matthew Stephens (slides) |
| 14:55 |
Break |
| 15:00 |
GUCS – File Similarity Digests Based on Text Content
Clay Shields (slides) |
In RAM We Trust: A Modern Approach to Forensic Processing
Vassil Roussev (slides) |
| 15:35 |
Break |
| 15:40 |
Sleuthing Beyond the ‘Kit: The Best Of The Rest
Cory Altheide (slides) |
| 16:15 |
Discussion |
| 16:25 |
Lightning Talks |
| 17:00 |
Networking Cocktail Reception |
