| 25. September |
Black Hall | Metalworking Hall | Training Room |
| Arrival shutle bus | |||
| 8:15 – 9:00 | Registration, welcome coffee |
||
| 9:00 – 10:15 | Keynote: „Cybercrime - from marginal phenomenon to prime crime" (Ralf Michelfelder, former president of LKA BW) (GERMAN) | ||
| 10:20 – 11:00 |
Erleben Sie mit uns live die Revolution im Bereich Threat Hunting (P) – Teil 1 (GERMAN) |
Using the PC-3000 Technological Mode approach to recover data from SSDs based on native USB controllers (P) |
Unlocking the Android keystore (P) |
| 11:05 – 11:45 |
Erleben Sie mit uns live die Revolution im Bereich Threat Hunting (P) – Teil 2 (GERMAN) |
Unveiling Detego’s Game-Changing Features: Transform Your Digital Forensics (P) |
What’s new in Encase and the Tableau range (P) |
| 11:45 – 12:05 | Coffee break | ||
| 12:05 – 12:45 |
Transforming Digital Evidence Handling with FTK (DE) (8.1) (P) |
|
Vehicle Forensics: Overcoming Challenges with Advanced Acquisition Techniques (P) |
| 12:50 – 13:30 |
Recovering Encrypted Evidence with Passware (P) |
 Smartwatches: Exploring Forensic Possibilities and Limitations of the most Popular Wearables (P) |
iOS Acquisition Methods: from Backups to Full File System Extraction (P) |
| 13:30-14:45 | Lunch | ||
| 14:45 – 15:25 |
Remote Access Forensics: Knowing Who Accessed The Computer - Brian Carrier (P) – Brian Carrier |
Geolocation of Human Trafficking Images: A Perceptual Colour-based Image Retrieval Approach (P) |
Advanced Analysis of PCAP and Phone data in Tovek Tools (P) |
| 15:30 – 16:10 |
Threat Hunting in Action! |
Make seizure decisions in seconds in child abuse cases. (P) |
 Understanding machine learning: The basics of AI |
| 16:10-16:30 | Coffee break | ||
| 16:30 – 17:30 |
Introduction of the Artefact Explorer in EnCase & the new TX2. (WS) |
Understanding Password Protection and the Decryption Workflow. (WS) |
Connecting dots from multiple sources using Tovek Tools. (WS) |
| 18:30 – open end | Networking dinner | ||
| 22:30 | Departure shuttle bus | ||
| 26. September |
Black Hall | Metalworking Hall | Training Room |
| Arrival shutle bus | |||
| 9:15 – 9:30 | Welcome coffee | ||
| 9:30 – 11:00 |
Exterro FTK 8.1 Training (WS) (Own laptop required!) Part 1 (DE) |
Capture the flag with Oxygen Forensics- WS (Bring your laptop!Part 1 |
Fast-track investigations with Detego Global’s award-winning tools -(Bring your laptop!) (WS) |
| 11:00-11:20 | Coffee break | ||
| 11:20 – 12:50 |
Exterro FTK 8.1 Training (WS) – (Eigenes Laptop benötigt!) Teil 2 (DE) |
Capture the flag with Oxygen Forensics (Bring your laptop!Part 2 |
 Investigating a Ransomware Case Using Cyber Triage (Eigenes Windows Laptop benötigt!) (WS) – Brian Carrier |
| 12:50-14:15 | Lunch | ||
| 14:15 – 15:15 |
|
 Introduction to Cyacomb 3.0. The gold standard in rapid triage for child abuse cases. ((Bring your Laptop!) (WS) |
 PC-3000 Mobile PRO solutions for flagship Mediatek CPU chipsets. (WS) |
| ab 15:15 | Networking drinks |
||
| 16:00 | Departure shuttle bus | ||
Efficiency in video analysis - How Amped Replay helps to shorten investigation times and at the same time strengthens the stringency in the preservation of evidence (P) (GERMAN)
Time zone: CEST (Germany)
(P) - Presentation
(WS) – Workshop
Information : To and from Kandel, Herxheim, Hayna and Jockgrim, in the mornings and evenings, we will provide a free shuttle bus .