Hoffmann Advanced Forensic Sessions

The number of participants was limited to 25 and the Advanced Forensic Sessions were fully booked quickly.  As a consequence, we were unable to enrol some subscribers. They were informed that comparable Sessions will be held in November 2009.

What was very nice to see was that we had a very international crowd with experienced forensic examiners coming from India, the UK, Switserland, Germany, Austria, Sweden and the Netherlands.

On Monday our guest speaker Lance Mueller kicked off with a two-day Advanced Vista Forensics Sessions. At the end of the first day we had a few drinks in the bar.

On Wednesday our own forensic experts presented the Hoffmann Sessions. Remon Verkerk and Joachim Metz started with a Session about Mac OS X and iPhone forensics. After that, Joachim Metz presented an Advanced Session about Office File forensics. During this Session the participating forensic examiners, among other things, used his libpff tools to examine and study the structure of an Outlook Pst file.

After a break and a dinner it was time for the last Session of the day, about Advanced File Carving. In this Session Bas Kloet and Robert-Jan Mora presented several new carving methods on different data sets. Attention was also given to the subject of measuring the quality of different carving methods. The set-up of the Sessions, namely keeping the number of participants limited, worked great: there was enough time to focus on difficult matters and to get acquainted with each other.

On Thursday and Friday guest speaker Andreas Schuster held the Advanced Memory and Malware Forensic Sessions. Andreas was the backup of Aaron Walters, who could not make it due to personal circumstances. Andreas turned out to be the perfect ‘backup’ expert. He taught us which evidence can be gathered and interpreted from memory and the techniques to do this.
On Thursday evening there was a dinner-cruise in the canals of Amsterdam. We all had a great time.

Every participant was requested to fill out an evaluation form. The response was very positive. We also got some useful comments on how to improve several things, regarding the duration, hotels and techniques for the next Hoffmann Advanced Forensic Sessions. It was nice to see that one of our own speakers, Bas Kloet, got the most positive feedback.

We asked the participants if they would come back if we organized the Sessions again. We were very glad to see that this question was answered with an unanimous yes.

There was a lot to learn for us as organizer of the event as well, but we had a great time in giving the Sessions. Until the next time.