Curious Case of Alice & Bob: What You Can Do as Digital Investigators
Walks through a real-world investigative narrative to show how digital artifacts in system registries fit into broader forensic investigations.
Summary
Narrative Driven Digital Investigation
Digital forensics investigations require moving beyond raw technical indicators to understand how individual clues fit into a broader case narrative. Framing investigative workflows around structured scenarios clarifies evidentiary relationships.
Uncovering Windows Registry Artifacts
System registries, event logs, and user activity artifacts contain critical forensic evidence. Locating and interpreting these keys reveals execution history, connected devices, and file interactions.
Contextualizing Evidence in Case Work
Determining why specific digital artifacts exist and how they correlate with timeline events allows investigators to reconstruct attacker actions or insider activity accurately.
Realistic Expectations for Forensic Analysis
Balancing technical tool capabilities against evidentiary limitations establishes realistic benchmarks for what digital forensics can conclusively prove during incident response.
Related talks
War Stories·22 min
Anthony Kava
Goes behind the scenes of a high-profile homicide investigation to show how command-line utilities and digital evidence unmasked an online stalker.
Blue Team Village·46 min
Project Obsidian
Project Obsidian explains forensic preparation and tooling organization to accelerate digital forensics and incident triage workflows.
Presentations Panels·1 hr 45 min
A deep dive into Windows Management Instrumentation (WMI) persistence, offensive abuse, real-time detection telemetry, and forensics.