Rapid Response and Data Collection -- Triaging for The Real World
- Rob Lee
- Monday, February 23rd, 7:15pm - 9:15pm
With the typical hard drive now averaging one terabyte in size, the fallout from the explosion of user-created data has become an overwhelming volume of potential evidence that law-enforcement, incident responders, and corporate investigators spend countless hours examining. Imaging entire hard drives has become unrealistic for the rapid and aggressive analysis required by most investigations today. Imaging and the resulting data sizes have resulted in the biggest anchor in the DFIR profession resulting in countless of useful hours lost in trying to achieve a standard that is nearly unreasonable. New techniques to help speed up triage and acquisition are needed to solve this issue. Learn a new approach in this unique session that will change the way you think about evidence acquisition forever.
Bonus Sessions
The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:
- SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
- Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
