DFIR Summit 2018

DFIR THINGS

DFIR SUMMIT 2018
Summit Dates: June 7-8, 2018
Training Course Dates: June 9-14, 2018

The 11th annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of ...

[+] Show More

Now Playing

DFIR THINGS

DFIR SUMMIT 2018 Summit Dates: June 7-8, 2018 Training Course Dates:...

Now Playing

DFIR Summit 2018 - The most comprehensive DFIR event of the year

For full Agenda, more information or to register visit:...

Now Playing

Automating Analysis with Multi-Model Avocados - SANS DFIR Summit 2018

In every case you work on, someone is asking you to get answers faster...

Now Playing

Finding and Decoding Malicious Powershell Scripts - SANS DFIR Summit 2018

Malicious PowerShell scripts are becoming the tool of choice for...

Now Playing

Evidence Generation X - SANS DFIR Summit 2018

Test evidence lies at the heart of our field. We need to be able to...

Now Playing

Logging, Monitoring, and Alerting in AWS (The TL;DR) - SANS DFIR Summit 2018

With AWS’ ever-increasing number services and ever-growing...

Now Playing

Every Step You Take: Application and Network Usage in Android - SANS DFIR Summit 2018

Every step you take, every move you make, your device and the network...

Now Playing

Living in the Shadow of the Shadow Brokers - SANS DFIR Summit 2018

Most people know the Shadow Brokers leaked (supposedly) stolen NSA...

Most people know the Shadow Brokers leaked (supposedly) stolen NSA cyber tools, which lead to some of the most significant cyber security incidents of 2017. But in addition to targeting ...NSA, the Shadow Brokers have also targeted a few individuals in our community. Hear about the history of the Shadow Brokers and the implications of their actions for infosec and DFIR from one of the group’s targets.

Have something you absolutely wanted to know about this great spy vs. spy saga, but were afraid to ask? This is your chance!

Jake Williams (@MalwareJake), Senior Instructor, SANS Institute
When a complex cyber attack put a private equity investment of more than $700 million on hold, the stakes couldn't have been higher. But that's exactly the kind of challenge that motivates Jake Williams, a computer science and information security expert, U.S. Army veteran, certified SANS instructor and co-author of FOR526: Memory Forensics In-Depth and FOR578: Cyber Threat Intelligence. To help mitigate the attack, Jake plied his information security expertise, discovered that not one but three different attackers had compromised the firm's network, and went about countering their moves.

Jake relishes the idea of meeting adversaries on the cyber battlefield. "I went into this field because I wanted a challenge," he says. "Infosec is like a game of chess to me. The attacker plays their moves and you play yours."

Jake started his information security career doing classified work with the U.S. government and was awarded the National Security Agency (NSA) Exceptional Civilian Service Award, which is given to fewer than 20 people annually. "I am immensely proud of the things I've accomplished," Jake says. "I'm positive the world is a safer place because of my work."

Today, Jake runs a successful Infosec consultancy. He's been involved in high-profile public sector cases including the malware analysis for the 2015 cyber attack on the Ukraine power grid. He's also tackled a variety of cases in the private sector. In one, Jake discovered attackers compromising a custom service the client had distributed to all its endpoints. Leveraging experience and insight with advanced persistent threats helped Jake "think like the attacker" and determine the attacker's likely hiding spots.

[+] Show More

Now Playing

#DFIRFIT or Bust! - A Forensic Exploration of iOS Health Data - SANS DFIR Summit 2018

We sit at computers all day long – day in and day out. We make...

We sit at computers all day long – day in and day out. We make excuses to not take care of ourselves. Sarah’s excuse was her long DC commute and ...Heather’s was not having enough time with her kids and travel. Since last year’s DFIR Summit, Sarah’s workplace location changed, affording her an extra hour a day; and Heather realized the baby weight wasn’t going to disappear on its own. We promised ourselves that we would get out from behind our computers (and/or steering wheel/baby carrier) and start sweating! We now have a friendly competition to keep each other honest on how frequently we are sweating at the gym and not just over casework.

As the Apple nerds that we are, we started logging lots of data into our iPhones using various apps, the Apple Watch and other gadgets. As the forensic data nerds that we are, we thought - how can this be used forensically? Recently in German courts the iOS Health data was used to determine if an accused person dragged a body down an embankment and walked back up. This activity was recorded as climbing stairs!

This presentation will explore the various types of data and sources of data that is stored in the iOS Health databases. By extracting and analyzing this data, we can determine a person’s pattern of life as well as any anomalies. When do they get up in the morning, when do they sleep? Where do they take their daily runs? How rigorous are their normal activities, what might have caused the data outliers during a specific time of interest in an investigation?

Sarah Edwards (@iamevltwin), Mac Nerd, SANS Institute, and Parsons Corporation

Heather Mahalik (@heatherMahalik), Principal Forensic Scientist, ManTech; Senior Instructor, SANS Institute

Sarah Edwards Bio:
A self-described Mac nerd, Sarah Edwards is a forensic analyst, author, speaker, and both author and instructor of SANS FOR518: Mac Forensic Analysis. She has been a devoted user of Apple devices for many years and has worked specifically in Mac forensics since 2004, carving out a niche for herself when this area of forensics was still new. Although Sarah appreciates digital forensics in all platforms, she has a passion for working within Apple environments and is well known for her work with cutting-edge Mac OS X and iOS, and for her forensic file system expertise.

Sarah's dynamic classroom and presentation skills have been heralded by both her students and colleagues. She keeps students interested and engaged. Sarah has more than 12 years of experience in digital forensics, and her passion for teaching is fueled by the ever-increasing presence of Mac devices in today's digital forensic investigations. Given the complexity of most cases and the high probability that an OS X or iOS will be a part of an investigation, deep knowledge of these Operating Systems is crucial to ensure that forensic analysts grasp all the information required in a case and not omit valuable data.

Heather Mahalik Bio:
To say that digital forensics is central to Heather Mahalik's life is quite the understatement. Heather has worked on high-stress and high-profile cases, investigating everything from child exploitation to Osama Bin Laden's media. She has helped law enforcement, eDiscovery firms, and the federal government extract and manually decode artifacts used in solving investigations around the world. Heather began working in digital forensics in 2002, and has been focused on mobile forensics since 2010 - there's hardly a device or platform she hasn't researched or examined or a commercial tool she hasn't used.

These days Heather is the Director of Forensic Engineering at ManTech CARD. At the SANS Institute she is a senior instructor and the course lead for FOR585: Advanced Smartphone Forensics. As if that isn't a full enough schedule, Heather also maintains www.smarterforensics.com, where she blogs and hosts work from the digital forensics community. She is the co-author of Practical Mobile Forensics (1st and 2nd editions), currently a best seller from Pack't Publishing, and the technical editor for Learning Android Forensics from Pack't Publishing.

Heather is passionate about digital forensics because she loves always having to learn something new. "This field moves so quickly. It is literally impossible to get bored," she says. "If you find yourself bored, branch into another realm of digital forensics. The possibilities are endless and so is the fun! I love digging for artifacts and solving the puzzle."

[+] Show More

Now Playing

$SignaturesAreDead = “Long Live RESILIENT Signatures" - SANS DFIR Summit 2018

Signatures are dead, or so we’re told. It’s true that many items...

Now Playing

A Planned Methodology for Forensically Sound IR in Office 365 - SANS DFIR Summit 2018

A planned methodology for developing and implementing a forensically...

Now Playing

Digital Forensics Truths That Turn Out To Be Wrong - SANS DFIR Summit 2018

In the field of digital forensics we go by a “rulebook” – a set...

In the field of digital forensics we go by a “rulebook” – a set of beliefs that we commonly hold as true. When I recently delved into the world of ...data recovery though, I found that we were mistaken about some really basic things, like that an SD card that reads all zeros in forensic tools is empty when in fact it can still contain hundreds of pictures, or that we’re getting a “full” forensic image of a hard drive with forensic tools when in fact we aren’t. This presentation covers the myths of digital forensics I always believed until data recovery techniques proved me wrong.

Cynthia Murphy (@cindymurph), President, Gillware Digital Forensic
Cindy Murphy served in law enforcement for more than thirty years, including twenty-five years at the Madison, Wisconsin Police Department, where she worked as a detective and a certified digital forensics examiner. While at MPD, she had the opportunity to serve as a detective and as a certified digital forensics examiner for over seventeen years. During her time as an investigator, she saw firsthand the emergence of mobile devices as the primary source of evidence in investigations. This pushed her to grow into the mobile forensics expert she is today and enabled her to co-author the SANS FOR585 Advanced Smartphone Forensics course. Just recently, Cindy took a leave of absence from the Madison Police Department to launch Gillware Digital Forensics, where she is co-owner and serves as president and lead examiner. As a life-long police officer, Cindy knows the transition from the public to the private sector to private will present new challenges, but she's looking forward to broadening her professional experience even further, which will benefit both Cindy and her students.

Throughout her career, Cindy has always looked for opportunities to help in meaningful ways. In one recent case, experts spent a year trying to unlock the phone of a 16-year-old girl who was killed in a tragic traffic accident. As the family prepared to spread the girl's ashes in a ceremony a year after her death, Cindy was given the victim's locked phone. She was able to unlock it, enabling the family to see their daughter's last photos. The family sent Cindy a thank you note that said: "We so appreciate this opportunity you've given us to hold onto a piece of our daughter's life we were sure was lost to us."

[+] Show More