A Visual Summary of SANS DFIR Summit 2022

On August 15-16, attendees joined us in Austin, TX or tuned in Live Online for the SANS DFIR Summit for its 15th anniversary!

We invited Ashton Rodenhiser of Mind's Eye Creative to create graphic recordings of our Summit presentations. If you missed a talk or are looking to view the Summit through a visual lens, take a look at the recordings below.

In addition to graphic recordings, PDFs of Summit presentations will be made available on the SANS Summit Archives page (SANS account required) and videos will be posted to YouTube over the next several months.

*If you registered for the Summit, video recordings are available on your Summit Access page in your SANS Portal.

Keynote: DFIR Evidence Collection and Preservation for the Cloud

Josh Lemon, Certified Instructor | Megan Roddie, Course Author

Building a Pattern of Life - Leveraging Location and Health Data

Jared Barnhart, Digital Intelligence Specialist, Cellebrite | Heather Mahalik, Faculty Fellow

Missing Pieces - Tips and Tricks on how to ensure your acquisitions aren’t missing critical data

A little bit of this, a little bit of dat

Stepping Out of the Android Malware Sandbox - Running & Analyzing Malware on a Physical Honeyphone

The Truth About USB Device Serial Numbers – (and the lies your tools tell)

Establishing Connections: Illuminating Remote Access Artifacts in Windows

Cracking the Beacon: Automating the extraction of implant configurations

Stay ahead of the game: automate your threat hunting workflows

Keynote: The Godfather of Forensics: How to Leverage Your “Year One” to Get an Offer You Cannot Refuse

Hunting for Active Directory persistence

Hunting threat actors using OSINT forensics

Conducting Forensic Examinations in Zero Trust Environments

Analysis Paralysis? Setting the Right Goal for Your Incident Analysis

WhatsApp with Your iMessage, Dude?!

Detecting malicious actors in Google Workspace

Updates in DFIR

If you'd like to check out our other upcoming Summits, you can view the latest listing here.