A few weeks back I got the chance to one again hit the SANS DIFR Summit down in Arlington, VA. This year was a triple topic system spanning DFIR, Threat Hunting, and Ransomware. I mostly focused on DFIR related talks but had some interest in the others when I had time.
SANS own Ryan Chapman, Mari DeGrazia and Ovie Carroll, the hosts
Here is a breakdown of the key sessions, technical highlights, and resources shared throughout the event.
Keynotes: From Anti-Forensics to AI Crime Scenes
The opening keynotes set a high technical bar, tackling everything from high-profile casework to cloud forensics without a disk image:
Heather Barnhart delivering the day 1 keynote
Anti-Forensics in the Idaho Murders Case: Heather Barnhart delivered a deep dive into the traces left behind when an attacker actively tries to leave no trace. The core takeaway: missing digital artifacts do not automatically mean nothing happened. By parsing raw Samsung logs using custom techniques outside of commercial tooling, investigators uncovered critical power events and successfully bridged mobile and computer evidence.
From Lilith to Truth: Jason Higley walked through a complex case study involving a U.S. Marshal and Craigslist revenge plots, highlighting how tracking IP addresses, cellular provider records, and digital posts can dismantle an elaborate deception. The case was documented in a recently released Netflix documentary called A Toxic Love Story.
Raymond DePalma delivering the day 2 keynote
The AI System Was the Victim: In a standout Day 2 keynote, Raymond DePalma explored forensic investigations in an environment with no traditional disk image. Focusing on a ticketing system exploited via malicious command injections to exfiltrate data, he outlined how log retention settings across cloud providers (AWS, Azure, GCP, and M365) dictate what an investigator can actually recover.
Technical Highlights & Artifact Deep Dives
The breakout tracks offered a wealth of actionable parsing and triage methodologies:
Brian Maloney talking OneDrive
OneDrive - Let's Take This Offline: Brian Maloney broke down the internal structure of OneDrive, detailing how to extract critical metadata from Sync Engine, Nucleus, and Quick Access databases (Microsoft.FilesOnDemand.db, Microsoft.FileUsagesync.db, and Microsoft.ListSync.db).
He also highlighted the forensic challenges of analyzing a secure local web server running directly on a target machine.
From Alert to Intent (Insider Threat): Justin Price (Johnson & Johnson) and Rakesh Kumar Narsignoju (Deloitte) tackled enterprise data exfiltration across USB, email, and cloud vectors. Their central thesis: tools hand you an alert, not the intent. They outlined a structured three-step framework (Triage, Investigate, Conclude) leveraging baseline comparisons, USB history tracking, and print job identification. Kudos to Rakesh for traveling 20 hours to give this talk too!
Lost in the Logs (Apple Unified Logs): Alexander Holecomb dove straight into the binary formats of Apple Unified Logs (tracev3, uuidtext, and timesync files
). Because many commercial tools miss critical mobile and macOS artifact details, he demonstrated low-level parsing strategies using native command-line utilities to extract volatile messaging and state data. A big thanks to the Mandient team for providing a parser for AUL because we are making a bunch of new artifacts for it in iLEAPP. More on this coming soon.
Panel with Raymond, Mari, Ovie and Heather
Panel Discussion: The AI Question in DFIR
A major highlight of the conference was the panel featuring Heather Barnhart, Ovie Carroll, Mari DeGrazia, and Raymond DePalma, tackling the practical realities of artificial intelligence in investigations. Key takeaways for practitioners included:
Never trust, always verify: Treat AI models like an intern, useful for drafting or accelerating workflows, but requiring constant validation.
Focus on artifacts, not tools: Your final reports must be grounded in verified system artifacts, not black-box model outputs.
AI is taking over everywhere (I even used it here to help draft this post). People are using it daily now for not only every day work but also work in our field. We have to make sure we put those guardrails in place so we get to the truth of the data.
Hands-On Workshop: Operation Phantom Thread
Attendees rolled up their sleeves for Operation Phantom Thread, a hands-on workshop utilizing Velociraptor to query 7+ machines simultaneously. Participants built custom artifact parsers and leveraged the Velociraptor Query Language (VQL) to trace an attacker’s footprint from initial foothold all the way to final exfiltration. Having played with it a little bit when I took FOR508 last year, it was a nice refresher into how awesome a tool it really is.
Resources
Here are some resources that were shared during the summit that I found might be use :
A big thank you to Jessica Hyde for allowing me to be her plus one to get a chance to attend. I met a bunch of new people and contacts and connecting with some long time friends. As always, hopefully I get another chance to attend again next year (we'll see what the future holds).
