A Visual Summary of SANS DFIR Summit 2026

On Thursday, October 15, and Friday, October 16, 2026, attendees joined us in Arlington and online for SANS DFIR Summit 2026. Across two days, practitioners shared real-world investigations, emerging research, and practical approaches spanning digital forensics, incident response, cloud and endpoint artifacts, data exfiltration, and AI in DFIR.

We invited Ashton Rodenhiser of Mind's Eye Creative to create graphic recordings of the DFIR Track presentations. If you missed a talk or want to experience the Summit through a visual lens, take a look at the recordings below.

*To access approved Summit recordings and presentations, log into your SANS Portal Account and visit the your SANS DFIR Summit 2026 Summit Access Page. Those should be available 1-2 weeks after the Summit.

Thursday, October 15

When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Dr. Mahesh Kalappattil, Sr. Principal Engineer at Palo Alto Networks

OneDrive - Let's Take This Offline

Brian Maloney, Lead IT Security Analyst at Thrivent Financial

Who Put Holes in my Cheese: The Swiss Cheese Model of Root Cause Analysis

Gerard Johansen, Principal at IR Proactive

From Drained Wallet to Threat Actor: A DFIR Investigation into ClickFix and Odyssey Stealer

Aidan Holland, Senior Security Researcher at Censys

Evidence Isn't on Disk: A DFIR Playbook for Compromised MCP Servers and AI Coding Agents

Samuel Addington, AI Researcher and Professor at California State University Long Beach

Christopher Earl, California State University San Bernardino

From Alert to Intent: Investigating Insider Data Exfiltration Across USB, Email, and Cloud in Enterprise DFIR

Justin Price, Director of Threat Detection and Response at Johnson & Johnson

Rakesh Kumar Narsingoju, Lead Managed Services Engineer at Deloitte

Squidoor: Dissecting a Sophisticated Multi-Platform Malware Used by a Chinese APT

Tom Fakterman, Senior Threat Researcher at Palo Alto Networks

Lior Rochberger, Principal Threat Researcher at Palo Alto Networks

Friday, October 16

KEYNOTE | The AI System Was the Victim: Forensics for a Crime Scene With No Disk Image

Raymond DePalma, President at DePalma Research LLC

Rogue VM Chronicles: Forensic Reconstruction of a Scattered Spider Intrusion

Cuong Dinh, Consulting Director at Palo Alto Networks - Unit 42

Justin De Luna, Senior Consultant at Palo Alto Networks - Unit 42

Tracing AI-Assisted IDEs: Forensic Artifacts, Agent Observability, and Software Supply Chain Risk

Ashwin Patil, Principal Security Researcher at Microsoft

Lost in the Logs: Navigating the Binary Format of the Apple Unified Log

Alexander Holcomb, Principal Consultant at Mandiant | Google Cloud

From Social Engineering to Asset Recovery: A Real-World Cross-Border Investigation into Cryptocurrency Theft

Abdalla Jamal Alshamsi, Detective Officer at Sharjah Police

Ahmed Belhay, First Lieutenant at Sharjah Police

DEBATE | The AI Question: What Does It Mean for DFIR?

Heather Barnhart, VP of Curriculum and Digital Forensics Expert at SANS Institute (Moderator)

Ovie Carroll, Director at DOJ Cybercrime Lab

Mari DeGrazia, Principal Instructor at SANS Institute

Raymond DePalma, President at DePalma Research LLC

If you’re interested in seeing what upcoming Summits we have in store for you, visit our SANS Summit listing.