The 2026 Conference Program is defined by primary topics. Therefore, each session has a primary topic designation for attendees to quickly find those sessions of relevance and importance to them. Sessions are also classified by both Target Level (Beginner, Intermediate, Advanced or All) and Target Audience (Corporate/Private Sector, Government, Investigators, Law Enforcement/Police, Prosecutors/Attorneys/Legal).

To sort by topics, audience, and levels to find the program that best suits your needs, click on Filters.

For a list of all sessions by day, please click on the day/date link.

Note - classifications are simply a guide to help attendees select the best sessions for individual needs/experience, and by no means should exclude or deter anyone from attending a session of interest.

Loading
08:00 AM
    Ballroom D&E
    Every generation faces a defining technological moment. Ours is unfolding right now. Artificial intelligence is redrawing the boundaries of creation. Digital identities are forming earlier and evolvin …
09:30 AM
    Meeting Room 106/107
     Despite heavy investments in cyber and physical security, low-altitude airspace remains a critical blind spot as drone threats grow. This session explores how airspace intelligence and drone forensic …
    Meeting Room 206/208
    Trade secrets make up the majority of value of U.S. companies' portfolios. Not surprisingly, such secrets are high value theft targets for domestic and foreign competitors. In one survey, half of the …
    Meeting Room 202/204
    Prolific threat actors have thrived on double-extortion; proving the ransomware economy remains strong. To hold organizations hostage, identity is now the target of adversary tactics, techniques, and …
    Ballroom C
    Seeing is not always believing. We know that intuitively when you witness a magician on the street, but it's harder to remember when a video is sent to us as proof of an incident. We take at face valu …
    Digital media backlogs are growing rapidly, forcing investigators to triage massive volumes of images and video, often containing disturbing content, under intense time pressure. Magnet Griffeye helps …
    Ballroom B
    Session details in progress
     Traffickers increasingly exploit technology to groom, recruit, and control victims. This session highlights how multidisciplinary teams—analysts, prosecutors, and social workers—collaborate throughou …
10:30 AM
    Meeting Room 202/204
    Achieving mission requires preparedness, insight, and agility in decision-making—no small feat given today’s complexities: heightened workforce skills, overwhelming information streams, and stringent …
    Ballroom C
     Deepfakes are everywhere in today’s headlines, fueling fear and driving a surge of “AI vs. AI” detection tools. But here’s the truth: recent research shows these solutions often fall short of their p …
    Meeting Room 106/107
     Cyber investigations increasingly require integrating OSINT with legal and cyber investigative processes. This session presents a structured, practitioner-focused approach to aligning OSINT, platform …
    Meeting Room 206/208
    Generative AI goes beyond document review, transforming early case assessment, investigations, and preparation for depositions, hearings, arbitrations, and trials. This panel brings together legal tec …
    Ballroom A
    A Panel discussion about the use of AI in Mobile Forensics (more to come)
    Ballroom A
    Session details in progress.
11:30 AM
    Meeting Room 206/208
    Proposed exhibits can be enhanced or created by Artificial Intelligence and generative AI. To be admitted into evidence, such exhibits must be authenticated by the party offering the exhibits and meet …
    Ballroom C
     AI applications are now widely used by both everyday users and criminals. This session explores how offenders misuse AI to automate tasks, enhance deception, and hide digital traces. We cover key for …
    Meeting Room 202/204
     In the mid-18th century, Benjamin Franklin recognized that communities needed a coordinated, volunteer-based system to fight fires and protect public safety. This presentation draws a direct parallel …
    Meeting Room 106/107
    DFIR investigations often span multiple tools, teams, and timelines, making it difficult to maintain clarity, consistency, and trust. This session examines the practical principles and best practices …
    Ballroom B
    Artificial intelligence is evolving rapidly, and investigative platforms must evolve with it. Traditional image recognition models have served us well, but they are limited in flexibility, scalability …
    Ballroom A
    Moderated panel with digital forensics experts on the above topic
02:00 PM
    Meeting Room 202/204
    Investigators rely on global information streams including multilingual news sources, government alert channels, social media, and specialized technical blogs. This session presents an open-source Pyt …
    Ballroom C
    Geolocation data is often pivotal in criminal investigations, but building a reliable location timeline from mobile devices is challenging. This session for forensic examiners, investigators, and pros …
    Meeting Room 206/208
    In this session, experts will discuss how modern AI empowers legal teams to make sense of large datasets and move efficiently from documents to actionable insights. Attendees will learn how AI can sur …
    Legacy DFIR stacks are slowing teams down with unreliable off network collections, brittle or bloated agents, and too many disconnected point products and scripts. This creates operational drag which …
    Meeting Room 106/107
    This session will cover the use of fintech applications in Human Trafficking Investigations, primarily the use of CashApp. It will describe its use as a source of intelligence driven investigation and …
    Ballroom B
    HANDS ON LAB: Part of the Tool Tactics class series, this hands-on lab delivers practical instruction in extracting actionable evidence from image and video files. Participants will work directly with …
    With the advent of encryption, NetFlow has become the standard for what we have available to analyze network traffic. In this hands-on lab, participants will learn what NetFlow is composed of and, usi …
03:00 PM
    Meeting Room 206/208
    In this session, legal and forensic experts will break down practical strategies for culling and filtering electronically stored information (ESI) during and after collection in an e-discovery project …
    Meeting Room 202/204
    Tracking a subject no longer relies solely on physical devices attached to vehicles. Investigators today can access a vast range of precise digital location data—from smartphones and apps to rideshare …
    Ballroom A
    Graphene OS are causing severe headache for Law Enforcement globally. In this session, we talk about how sensitive we need to be in the industry of mobile forensics when sharing knowledge our capabili …
    Ballroom C
     This two hour panel prepares digital forensic examiners for AI related challenges in court. It will feature two seasoned digital forensic examiners and two attorneys fluent in the current AI world, t …
04:00 PM
    Meeting Room 206/208
    Learn how North Korean IT workers infiltrate enterprises using stolen identities, contractor loopholes, & remote-work obfuscation. This session teaches practical OSINT, remote digital forensics, UBEA …
    Meeting Room 106/107
     This case study shows how rapid patrol response and mobile device forensics turned a local complaint into a federal child-exploitation conviction. It covers key decisions, digital grooming analysis, …
    Meeting Room 202/204
    As AI technologies become increasingly accessible, cybercriminals are rapidly integrating their capabilities into their attack methodologies. This session examines the emerging threat landscape where …
    Mobile devices now represent most of the digital evidence in criminal investigations, yet increasing device volume, storage size, and security have created significant acquisition and workflow challen …
    Ballroom A
    Session details in progress.
08:30 AM
    Meeting Room 202/204
    The spreadsheet of doom—that sprawling tracker of timelines, observables, and case notes—remains the backbone of incident response at top firms. AI should help here. Often it doesn't. This session sha …
    Ballroom C
     eCall and vehicle connectivity modules store critical forensic data generated during vehicle operation and emergency events. This presentation examines how such data can be extracted and analyzed in …
    Meeting Room 106/107
    The goal of this session is to educate law enforcement about the Snapchat application and ways to work with the Snapchat Law Enforcement Operations team. This session will cover what data might be ava …
    Ballroom A
    As modern smart devices and applications continue to implement stronger security controls, password and passcode recovery has become an increasingly critical and often time-sensitive component of digi …
    Meeting Room 206/208
    It began in the late 1980's with the emergence of personal computers using spreadsheet software to build huge end-user ad hoc desktop applications without the involvement or approval of the Informatio …
    Ballroom B
    Digital investigations do not slow down because of a lack of data. They slow down because of too much of it. This hands‑on lab shows participants how to precisely filter investigator‑relevant data fro …
    Meeting Room 104/105
    This session provides hands-on instruction in using open-source tools for mobile and digital forensics. Attendees will gain practical experience acquiring, parsing, and analyzing data from both Androi …
09:30 AM
    Meeting Room 106/107
    Case study involving a husband and wife, Alexandria Stevens and Michael Taylor, who produced CSAM with the wife's 7 year old sister, attempted with her minor brother as well, and solicited children on …
    Meeting Room 202/204
    This session explores how AI-powered deepfakes can alter faces, voices, and messages, featuring real demo of what current tools can create. This session will share how deepfakes can be used to deliver …
    Ballroom A
    This study examines the accuracy and reliability of geolocation data from iOS and Android devices, with a focus on its forensic and legal significance. For iOS and Android, location data is tested aga …
    Digital evidence volumes continue to expand while investigative teams and legal stakeholders operate across jurisdictions, time zones, and disciplines. The result is often fragmented: separate tools, …
10:30 AM
    Ballroom C
     IoT devices are everywhere and causing potential chaos with the data they collect and store. With risks to digital security and information sharing they are becoming a prime suspect in digital eviden …
    Meeting Room 202/204
    Attendees will learn how cloud-based criminal analytics enabled investigators to correlate communications, movements, and digital identities; reconstruct timelines across borders; and expose hidden co …
    Meeting Room 206/208
    As investigations span physical devices, removable media, and legacy data, maintaining a defensible digital chain of custody is increasingly complex. This session examines practical, process-driven be …
    Meeting Room 106/107
    This session will cover human trafficking trends in crypto, highlighting the forced labor behind many crypto scams, covering a case study of CSAM and live streaming abuse in the Philippines, and highl …
    Ballroom A
    Session details in progress.
11:20 AM
    Ballroom B
    For many years, recovering deleted files was considered a routine outcome of physical extraction in mobile forensics. However, Android’s encryption model has evolved significantly — from Full Disk Enc …
11:30 AM
    Meeting Room 202/204
     This session provides responders with an in-depth analysis of the evolving ransomware threat landscape, examining how major ransomware groups have adapted their TTPs over the past year. Drawing from …
    Ballroom C
    Digital investigations are evolving faster than most traditional forensic tooling can adapt. In this session, we’ll explore why modern investigators benefit from adopting developer-style tools—includi …
    Meeting Room 106/107
    This session examines how digital exploitation and trafficking investigations are shaped by investigative tradecraft influenced by registry-based and monitoring systems. It will explore how reliance o …
    Ballroom A
    Session description in progress
    Meeting Room 206/208
    An in-depth look into the investigation of TD Bank. Agents will discuss where it started, typologies the bank failed to catch, and AML areas that were the bank was criminally non-compliant. The presen …
02:00 PM
    Meeting Room 202/204
     Open-source information is increasingly distorted by synthetic content, false identities, and deceptive digital activity. This session teaches practical methods to validate OSINT data in investigatio …
    Meeting Room 206/208
    As the crypto industry strives for legitimacy, a shadow economy persists. This session uses blockchain data to uncover how criminal syndicates obfuscate capital flows. We reveal over 32,000 annual "tr …
    Ballroom C
    Test points have long been used in mobile forensics to place devices into specific operational modes for acquisition and analysis. This session will provide a deep dive into test points, focusing on h …
    Meeting Room 106/107
    This session provides law enforcement with an overview of the Roblox platform, its safety and parental control features, and how to work effectively with Roblox to obtain timely responses to lawful re …
    What does the Magnet Verify team do after revolutionizing media authentication with a novel, patented approach to file structure analysis? They continue to research and innovate to find yet another ne …
    Ballroom A
    Session details in progress.
03:30 PM
    Meeting Room 206/208
    In today's digital age, the impact of cybersecurity breaches on organizations can mirror the profound effects of personal loss, leading to what can be described as 'cyber grief.' This session explores …
    Ballroom C
    The era of “many hands” in digital forensics has arrived, with investigations spanning multiple agencies, devices, and stakeholders. Live collaboration is now essential—but true collaboration requires …
    Meeting Room 202/204
     AI that once required data centers and specialized expertise can now be spun up in a bedroom or back office using entirely free tools. This has opened the door to a wave of misuse: deepfake harassmen …
    Meeting Room 106/107
    In 2024 the NC SBI Computer Crimes Unit along with more than 40 local, county and federal law enforcement agencies conducted a multi-agency operation known as “Operation Winter Guardian”. This operati …
    Ballroom A
    As mobile devices increasingly limit the availability of persistent network artifacts, volatile memory has become a critical, yet underutilized source of evidential data. This session explores how MAC …
    Ballroom A
    Session details in progress.
08:30 AM
    Meeting Room 206/208
    Agentic AI represents a shift from models that merely generate text to systems capable of autonomous, goal-directed action. This session examines how early AI coding agents, such as Claude Code, can b …
    Ballroom C
     In this presentation I will go through my forensic workflow. I will discuss how I intake and image items in a timely and efficient manner. I will discuss the storage of case data, how I process cases …
    Ballroom C
    Business Email Compromise (BEC) has evolved from simple credential theft into a persistent, cloud-native threat that bypasses traditional investigative assumptions. Modern attackers abuse trusted serv …
    Ballroom A
    Encryption is now a default feature across iOS, protecting both system and application data. While many forensic tools automatically decode portions of this data, examiners are increasingly encounteri …
    Meeting Room 202/204
    Ballroom A
    Session details in progress.
09:30 AM
    Meeting Room 206/208
    Public-web and social media content are core inputs to OSINT-driven investigations, yet screenshots and consumer capture tools often fail under legal and forensic scrutiny. This session explores why t …
    Meeting Room 202/204
     As cyber threats grow increasingly sophisticated, traditional reactive approaches to incident response are no longer sufficient. This presentation explores how proactive threat hunting can be seamles …
    Meeting Room 106/107
    Dark web activity shows threat actors using compromised law enforcement email credentials to train AI models that generate realistic subpoena forgeries at scale. This session explains attack methods a …
    Ballroom C
    We are in an era where search engines are being augmented or replaced by prompts using ChatGPT, Gemini, Claude, Llama or equivalent. These technologies can be used in digital investigations to find re …
    Ballroom B
    Modern internal investigations, incident response engagements, and e-discovery matters increasingly require the collection of data from geographically dispersed and technically diverse sources. Releva …
    Meeting Room 104/105
     Professionals in cybercrime, digital forensics, and law enforcement face repeated exposure to graphic material, high-stakes decisions, and overwhelming caseloads, conditions that fuel vicarious traum …
10:30 AM
    Meeting Room 206/208
    You've had a ""true positive” security event on a Windows or Linux endpoint (or more than one)! Now what!? Combining investigative methodology with creative utilization of some free tools and custom s …
    Meeting Room 106/107
    This case highlights mobile forensics in CSAM investigations, from tipline reports to courtroom prosecution. Investigators extract and analyze data from devices while preserving evidence integrity. Ex …
    Ballroom C
    Advances in Artificial Intelligence are reshaping the way digital investigators uncover, analyze, and interpret evidence - revealing insights that were once impossible. With this innovation, come impo …
    Meeting Room 202/204
    Navigating SQLite Write-Ahead Logs is essential for digital forensic investigators, particularly when examining unsupported or partially supported applications. This session guides you through the man …
    Ballroom A
    Modern Android devices increasingly generate background data designed to anticipate user behavior and optimize app usage. One such artifact “pkgpredictions.db” is present on Samsung devices and other …
    Ballroom A
    Session details in progress.
11:30 AM
    Meeting Room 202/204
     AI is everywhere. For marketing teams, it means sticking a "Powered by AI" logo on something and adding a 20% markup. Whether in government, industry, or academia the benefits when tied to forensics …
    Meeting Room 106/107
    This session will demonstrate how RAM analysis enables the decryption of unsupported encrypted Android app databases—revealing evidence that was once considered inaccessible. Attendees will learn how …
    Meeting Room 206/208
     Digital evidence is everywhere, but the gap between technically sound and legally defensible is where cases are won or lost. This rapid-fire session delivers 25 practical lessons across eDiscovery, f …
    Ballroom B
    Grants are highly beneficial to law enforcement agencies because they provide critical funding beyond local tax revenue, allowing departments to enhance operations, improve public safety outcomes, and …
    Ballroom C
     As anonymization tools and cryptocurrency adoption expand, criminals increasingly exploit anonymous networks and digital assets to conceal identities, launder funds, and coordinate illicit activity. …
    Today’s vehicles are rolling data sources. They can record data like location history, connected phones, and system activity that helps place people, devices, and actions at key moments in an investig …
02:00 PM
    Meeting Room 206/208
    This session will explore how Digital Forensics and Incident Response teams can significantly strengthen their investigative capabilities by adopting OSINT methodologies pioneered outside the cybersec …
    Meeting Room 106/107
     Online gaming platforms, including mainstream titles and child exploitation themed games, are increasingly leveraged to groom children, produce CSAM, and facilitate sexual abuse. This session examine …
    Ballroom C
     Uses for ESD k9 in ICAC cases and a case study of Brayden Bull and the implications of that case in tribal jurisdictions.
    Meeting Room 202/204
     AI tools give law enforcement an advantage in their investigations. But how do you properly use AI tools without unknowingly violating laws or policies by uploading case information into public AI to …
    Ballroom A
    Joint Presentation with MSAB & Project VIC
    Ballroom B
    This talk examines how we’ve approached building a more connected workflow. Using Detective’s Command Line Interface, data ingestion from our extractor or third-party extraction tools can be automated …
03:00 PM
    Meeting Room 206/208
    Digital forensic investigations often assume evidence will surface through artifact recovery. This session examines a serial homicide case where repeated extractions produced nothing—and that absence …
    Meeting Room 106/107
     A brief look at some of the tools and tricks of using Adobe Premiere to effectively present videos and other details in your case. Taking hours of video or multiple sources of information and present …
    Ballroom C
    This session examines blockchain forensic techniques used to investigate crypto money laundering, including practical tactics for tracing illicit digital asset transactions. Attendees will learn how t …
    Digital evidence now drives the outcome of most civil disputes, yet many discovery battles are lost not because of technology, but because of drafting. This session equips litigators with a discipline …