​Please join us for our digital forensics seminar w/ Mark Spencer and Arsenal Forensics. 4 CPEs. Lunch provided.

​Tentative Schedule:

​9:30am - Check In
10:00am - Seminar Begins
12:00pm - Lunch Served
2:00pm - Conclusion

​Sessions:

​"High Stakes Evidence Tampering and the Failure of Digital Forensics"

​Discussions about electronic evidence tampering are often academic, leaving participants skeptical about the practicality of various tools and techniques they have just seen. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case — from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Arsenal President Mark Spencer will demonstrate the “Anchors in Relative Time” analysis technique which ultimately revealed that the journalists computers were attacked both locally and remotely, including the use of a RAT never seen before (or since) in the wild. Due to the sensitive nature of this presentation, it is only available in-person and recording will not be allowed.

​“Windows Arm-on-Arm Virtualization for Digital Forensics Practitioners”

​Encountering a tablet or laptop running Windows on ARM (WoA) is no longer a theoretical matter for most digital forensics practitioners. Major computer manufacturers including Microsoft, Dell, and Lenovo have been selling ARM-based tablets and laptops running WoA 10 and 11 for over five years. Multiple generations of the Qualcomm Snapdragon processor power many of these devices, with the X/X Plus/X Elite series found in devices sold today and the X2 series on the horizon. While Windows x64 and WoA may look similar, they are actually quite different - especially in terms of driver robustness and virtualization features important to digital forensics practitioners. When we realized that it was (A) not possible to launch disk images from devices running WoA on our forensic workstations running Windows x64 and (B) WoA did not support virtualizing actual physical disks and (C) WoA did not support virtualizing disk images from real hardware, we set out to address these problems. Attendees of this presentation will see powerful new capabilities available to digital forensics practitioners thanks to aggressive R&D over the last year. Depending on the nature of the audience, sensitive analysis techniques may be discussed which require in-person attendance only and recording will not be allowed.

​

​About Our Speaker

​Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon, where he guides development of digital forensics tools. He has more than 25 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of terrorist organizations and military coup plotting. Mark has testified in cases which include United States v. Mehanna and United States v. Tsarnaev.