Speakers

Forensic investigation in Windows systems through Registry analysis

ICS SOC Analyst (Security Operation Center of Industrial Control System Analyst) Born and Raised in São Paulo, Brazil, Married, Mabel Father’s (my dog), likes books, games, movies, series, history and documentary, nerd stuff. My background is about 18 years between Technology and Cybersecurity where I have more than 10 in work as a cybersecurity consultant, 2 years on cybersecurity for the industrial control system environment. My graduation is related, System analysis and Development and post graduation in Cyber Security, Computer Forensics, Cyber Threat Intelligence.

Andrea is a member of Magnet Forensics’ product marketing team, having joined in March 2020. With a customer-focused approach, she drives initiatives that uncover and communicate the value of Magnet’s digital investigation solutions for internal investigations, eDiscovery, and incident response. Andrea has over 13 years of marketing experience in a variety of different industries including cybersecurity, technology, and retail.

An introduction to media file structure for digital investigations

Bertram is a co-founder of Medex Forensics and has over 2 decades of experience in managing digital assets, including time as the first digital archivist of the American Folklife Center (AFC) at the U.S. Library of Congress. Bert has supported complex data and software development projects for organizations globally, including the Federal Bureau of Investigation (FBI), the Smithsonian Institution, the Library of Congress, the JFK Presidential Library Foundation, HBO, Paramount Pictures, University of Kentucky, Indiana University, Yale University, Facebook, and Spotify, among many others. Bert is an Associate Member of the American Academy of Forensic Sciences (AAFS) and an active member of the Scientific Working Group on Digital Evidence (SWGDE). He has received certification from the Academy of Certified Archivists and is a graduate of the Archives Leadership Institute. He holds an MA in museum studies with a focus in American studies and archival theory from the University of Kansas.

macOS Lockdown Mode: a forensic deep dive

Bhargav Rathod is a Security Analyst at Salesforce with a strong focus on macOS Forensics and Malware Analysis. Holding an MS in Digital Forensics, he is also GIAC GIME Certified. He has made significant contributions as an Organizing Committee member for the DFRWS USA & DFRWS APAC Conferences, helping to shape the discourse and direction of these prestigious events. He has previously presented at DFIR SANS Summit 2023 and BSides Ahmedabad 2024. His areas of interest are DFIR & Malware Analysis.

Magnet Virtual Summit 2025 keynote: addressing the tipping point of DFIR

Braden Thomas is Chief Product & Research Officer at Magnet Forensics. Braden has 14 years of experience working in the information security field as an engineer and researcher at Apple, Accuvant, and Optiv. Prior to Magnet, Braden was a Principal Research Scientist as Optiv, where he consulted with companies to improve the security of their embedded device products. A recognized expert in vulnerability research, Braden has spoken at several conferences on topics of on applied cryptography and embedded device security. Braden holds a BS and MS in Computer Science from University of Southern California.

An introduction to media file structure for digital investigations, The inside scoop on digital evidence standards

Brandon Epstein is an experienced digital forensic examiner, spending most of his law enforcement career as a police detective and digital forensic examiner. Brandon holds a Master of Science degree in Recording Arts – Emphasis Media Forensics as well as numerous digital forensic certifications. He is the chair of the Scientific Working Group on Digital Evidence and is a member of the IAI’s Forensic Video Certification board, IACP Cybercrime and Digital Evidence committee, NIST/OSAC Video/Imaging Technology and Analysis Subcommittee, and is a fellow the American Academy of Forensic Science. Brandon is also an adjunct professor in the New Jersey Institute of Technology’s Forensic Science Program and regularly provides digital forensic instruction to local, state, and federal law enforcement officers nationwide and internationally. Prior to joining Magnet Forensics, Brandon was a co-founder of Medex Forensics, where he helped digital forensic examiners and investigators determine the trustworthiness of digital evidence, establish when a video has been edited or modified, and recognize original camera video from synthetically produced media.

Thinking beyond tools: elevate your DFIR skills with an investigative mindset

Brett Shavers is a digital forensics consultant, author, and instructor who’s logged more hours behind a keyboard than he’d care to admit. With a background in law enforcement and an intuitive grasp of suspect behavior, Brett has carved out a unique niche in DFIR—one that, if he’s honest, involves more coffee than forensic analysis. His Placing the Suspect Behind the Keyboard series has become a go-to for investigators eager to understand not just what suspects did, but why they did it—and placing suspects at a device. 

Known for his no-nonsense, slightly irreverent style, Brett teaches with a blend of school of hard knocks insight, practical advice, and the occasional eye roll at the absurdities of cybercrime. After all, if you’re going to chase suspects across cyberspace, you might as well enjoy the ride.

To cloud or not to cloud—that is the question

Brian Salmon is a Technical Lieutenant for the New York State Police. He is responsible for the HQ digital forensic laboratory and the statewide digital forensic program. He has been doing digital forensics since 2008, including working as a civilian forensic analyst, Investigator, Senior Investigator, and has been in his current position since 2022.

Six pillars of digital forensics, Addressing mobile backlogs and bottlenecks with Magnet Forensics, Give your agency an investigative edge with Magnet One

Chad Gish works with Magnet Forensics, a leading digital forensics company. He is part of the Technical Marketing Staff and works as a Forensic Consultant. Chad had a wonderful 26-year career with the Metro Nashville Police Department, dedicating 24 years as a detective working on major, high-profile cases. For nearly 20 years, he focused on digital forensics, accumulating over 4000 hours of specialized training while managing a wide range of investigations, including hundreds of homicides and crimes against children.

Chad’s contributions to the MNPD are significant. He played a key role in designing, building, and managing a state-of-the-art digital forensic lab. His involvement in various MNPD committees, including those for information security incident management and the implementation of body-worn cameras, has been instrumental. He also helped lay the groundwork for the MNPD’s state-of-the-art Real Time Crime Center, a project that has had a profound impact on the department’s operations.

Recognized as a court-identified expert in digital forensics, Chad has provided expert testimony in hundreds of cases across local, state, and federal courts. His expertise is further shared through lectures at the police academy and presentations at various conferences and organizations.

Chad was a highly dedicated detective, receiving commendations such as Tennessee Police Officer of the Year, a three-time recipient of the United States Attorney’s Award for Excellence in Law Enforcement, multiple Investigator of the Month awards, and induction into his hometown’s Hall of Fame. His exemplary work during the investigation of the Christmas Day bombing in downtown Nashville earned him recognition from the FBI director.

Mobile Unpacked S3:E2 // apples, onions, and ogres: dealing with layered iOS data structures

Chris Vance is a Staff Technical Forensics Specialist with Magnet Forensics where he has been for the past 8 years. He has been an instructor, researcher, and curriculum developer for several major forensic software companies focusing primary on mobile device, macOS, and cloud research. He previously worked for the West Virginia State Police for a number of years as a Digital Forensics Specialist working on a wide array of case types. He hails from Huntington, WV where he has received a degree in Digital Forensics as well as a Masters in Cyber Forensics & Security.

Rotten to the core: investigating iOS stalkerware

Chris works for one of the top US digital forensics training organizations, previously serving as a law enforcement officer investigating cyber crimes. Chris has over a decade of professional experience in digital forensics and information security.

Chris especially enjoys mobile device security and forensic research.

He currently resides with his wife and children in West Virginia, USA.

New methods for AI media classification

David Weichselbaum is Chief Research Officer and Partner at the digital forensics company T3K.ai.

During his degree in Molecular Biology, he was an early adopter of machine learning for molecular interaction prediction and quantum chemistry simulations and co-founded a transgenics company. He joined T3K in 2017 to help develop the company towards automation and AI.

Solving a case with Magnet Witness and cutting-edge video analysis

With over 14 years of experience in digital forensics, Deepa A S serves as the Assistant Director at the State Forensic Science Laboratory in Thiruvananthapuram, Kerala. She is a nationally recognized digital forensic expert, officially notified as an Electronic Examiner of Evidence under Section 79A of the IT Act, bringing credibility and expertise to high-stakes cybercrime investigations across India. Her extensive technical proficiency includes mastery of forensic tools such as Magnet, Encase, FTK, UFED Cellebrite, Amped, XRY, and more, underscoring her capability to extract and analyze critical digital data from a range of damaged devices, including mobile phones, tablets, and chip-based storage.

Throughout her career, Deepa has solved close to 1,500 cybercrime cases, and her role as an expert witness has seen her present evidence in over 250 court cases across Kerala, demonstrating her strong understanding of chain-of-custody protocols and evidence handling. Deepa is also certified across numerous forensic platforms, including Cellebrite Physical Analysis, Mobilyze Operation, and XRY advanced acquisition, which she applies effectively in diverse digital forensic and cybercrime investigations.

Deepa’s contributions to the field have been formally recognized through awards such as the Badge of Honor from the Kerala Police in 2021 for her work in solving a high-profile child pornography case, as well as Good Service Entries from the State Police Chief and ADGP (Crime Branch). Her commitment to confidentiality, precise reporting, and supporting sister organizations further distinguishes her as a respected figure in digital forensics.

As a speaker, Deepa brings not only a wealth of technical knowledge but also her unique perspective from years of frontline experience in cyber forensics, investigation, and expert testimony, providing valuable insights into the complexities and evolving challenges in digital forensics today.

Tackling the data management challenge with cloud

Doug Gartner assists strategic technology partners and public sector agencies with their technical application architectures. He has designed and developed many large-scale systems and applications leveraging Amazon Web Services (AWS). Mr. Gartner has over 15 years of software engineering experience with primary expertise in distributed systems and data engineering.

Unlocking DFIR: free resources for efficient triage and acquisition, Zen & the Art of Digital Forensics: Enhancing Insight Through Mindfulness

Doug Metz is a Senior Security Forensics Specialist at Magnet Forensics. He joined Magnet in 2021, bringing over 13 years of experience as an Incident Response Manager. Doug currently serves as Vice President for the Delaware Valley Philadelphia chapter of the HTCIA. Doug blogs at BakerStreetForensics.com and hosts the “Cyber Unpacked” webcast, exploring topics in Digital Forensics and Incident Response for the Enterprise.

Regulators and litigators: new threat actors?

Douglas proudly serves as a court-appointed Special Master and testifying expert in high-profile litigations involving cybersecurity, information governance, data privacy, and eDiscovery.

He is a pioneer and globally recognized expert in duty of care, cybersecurity best practices, reasonable program design, and legally defensible responses to data incidents, regulatory inquiries, and litigation responses. Douglas has conducted hundreds of digital forensic and incident response investigations involving hacking, data breaches, trade secret theft, employee malfeasance, and other legal and compliance issues. He has testified and provided expertise in federal and state district courts. He has been appointed Special Master in several high-profile federal privacy litigations, including Brown et al. v. Google (2021), Calhoun et al. v. Google (2021), and In re: Google Inc. Street View Electronic Communications Litigation (2014).

As founder and president of Brush Cyber, Douglas’s business services include dispute consulting, interim CISO services, SEC cyber readiness, privacy and governance consulting, enterprise risk assessments, and end-to-end data protection solutions. Recently, Douglas also served as one of Splunk’s elite Global Advisory CISOs and was named their Security Specialist of the Year for FY2021.

He is a Fellow at the Academy of Court-Appointed Neutrals (ACAN), where he champions ESI and discovery neutrals for class action litigations involving complex data and IT systems. Additionally, Douglas spearheads efforts with the Sedona Conference, the EDRM, and the ABA to resolve the complex eDiscovery issues to balance costs, court deadlines, and litigants’ needs.

As an industry visionary, Douglas is continuously at the forefront of emerging industry threats and trends and speaks internationally on cybersecurity & data security topics. In addition to continuous research underpinning his legal and business services, Douglas hosts the weekly podcast Cyber Security Interviews, which features cybersecurity, business, legal, and regulatory leaders.

Simplified digital investigations for evolving business needs

Drew Roberts joined Magnet Forensics in 2018 and has over 10 years experience in product management. Since joining Magnet Drew’s primary focus has been serving the unique needs of Magnet’s private sector customer base. Drew played a key role in the product launches of Axiom Cyber and Automate Enterprise, and currently serves as Director, Product Management for private sector DFIR.

Prior to joining Magnet Drew spent 8 years in financial services software, helping provide solutions to major banks targeted at both treasury and consumer banking. Drew holds a Bachelor of Mathematics in Honours Computer Science with a business option from the University of Waterloo.

Overview of AI tech for digital forensics

Skills || Experiences || Accomplishments organized as per definition of cyberdomain in the Tallinn Manual v2:

Social Layer (partial list)

— Using OSINT and SIGINT, hunted and captured India’s most wanted terrorists, scammers from Nigeria and Liberia, Chinese kidnappers who rape and torture victims, and helped find Australia’s most evil child abuser, all in the Philippines

— Continues to hunt and shut down South East Asian gangsters who operate online gambling sites

— Using cryptocurrency forensics, continues to hunt Chinese kidnappers

— Using mobile phone and computer forensics, was contracted by Philippine Supreme Court to help prosecute a corrupt judge

— Authenticated the results of Philippine’s first Automated Election System in 2010

— Attributed criminal hacking of Philippine government websites to China

— As a pentester, successfully breached online banking systems in PH, to demonstrate beyond reasonable doubt, risks regarding ATM cash withdrawals or fund transfers, or credit card tampering

— ISO/IEC 27001 (ISMS), COBIT, and Common Criteria (ISO/IEC 15408) auditor

— Pioneered the development of Digital Forensics Manual for PH Department of Justice (DOJ), Commission on Human Rights (CHR), and Cybercrime Investigation and Coordinating Center (CICC)

— Fulfilled five missions by UNODC, as Advisor to Philippine delegation to the Ad Hoc Committee on Cybercrime

— Now on third mission as a member of UN’s government experts on drafting a legislative guide on combating fraud

— Head of AI Committee for US-based Scientific Working Group on Digital Evidence (SWGDE)

— Contributing member of PH team in the ISO/IEC (JTC 1/SC 42) Artificial Intelligence Committee, specifically WG3 on Trustworthiness

— CICC’s Lead Developer on three AI-based digital forensics systems, in collaboration with De La Salle – College of Saint Benilde, as funded by DOST-PCIEERD (Department of Science and Technology)

— Developing for CICC open-source AI systems using different LLMs and RAG to share standardized Digital Forensics Manual for everyone

— Recognized as a digital forensics expert in many Philippine metropolitan trial courts, in Arbitration Centers in Philippines and Singapore, for many types of cases (e.g. homicide, estafa, voyuerism, libel, election fraud, bank fraud, securities fraud, internal fraud, etc.)

Logical Layer

Unified Communications Domains: Fixed, Mobile

Protocols: IP, TCP, UDP, HTTP/S, DIAMETER, RADIUS,SS7, OpenRAN

Physical Layer

O/S: Solaris, HP-UX, AIX, Linux, Windows, MacOS, iOS, Android

Filesystems: NTFS,XFS,EXT[3,4], exFAT, FAT32,ZFS, HFS+,APFS,UFS

ISO/IEC: 22237 (data center), 31307 (CCTV), 11801 (TIA 568 cabling)

The leadership mindset, from call to court and beyond

Ed O’Carroll began his public career as an Emergency Medical Technician and Assistant Chief of an ambulance squad in Hauppauge, New York. As a young adult, Ed relocated to Virginia and began his service with the Fairfax County Police Department on September 11, 1989, and retired as a major/bureau chief on February 3, 2023. During his 33-year career with the police department, Major (Ret.) O’Carroll had served in every position from cadet to major. His most recent assigned was serving as the Bureau Chief of Major Crimes, Cyber and Forensics, which oversaw all criminal/violent crime investigations, victim services, search and rescue, digital forensics, human trafficking, missing persons, and the Language Services Support Unit.

New methods for AI media classification

Gareth Ballance is Head of Product Management at T3K.AI. His background is in natural sciences with a degree in biochemistry, however, he further completed a Master’s degree in Forensic Engineering and Science, and from there began a career specializing in digital forensics. He previously worked as a Digital Forensic Specialist at a UK Police Authority and a Governmental Fraud Agency. Since 2019, he has been working at T3K providing digital forensic professional services and product management.

Magnet Virtual Summit 2025 keynote: addressing the tipping point of DFIR

After several years combating crime as a police officer and digital forensics investigator, Jad Saliba decided to expand his impact by founding Magnet Forensics in 2011. He wanted to address the challenges caused by the constantly increasing presence of technology in modern crime. As Chief Innovation Officer at Magnet Forensics, Jad is focused on staying ahead of criminals in all of their attempts to stay hidden in the digital world—often in cases involving terrorism, child exploitation, or corporate cybercrime. His efforts, alongside those of all Magnet employees, have led to thousands of agencies around the world being able to solve more cases in less time—which drives Jad and his team even harder in their mission to seek justice and protect the innocent.

Rethinking digital forensics in incident response

Jason Jordaan is leading digital forensics, incident response, and cybercrime investigation specialist. He has been acknowledged in as an expert witness in the High Court of South Africa. He began his digital forensics career in the early days of the development of the digital forensics discipline when he combined his love for computers and technology with his role as a police detective. He served as a detective with the South African Police Service Commercial Branch, before moving to the Special Investigating Unit, where he established their digital forensics laboratory. In 2014, after being instrumental in multiple high-profile investigations over 23 years of service, he resigned from his position as National Head of Cyberforensics to establish DFIRLABS. As the founder and Principal Forensic Analyst of DFIRLABS, Jason leads the practice, and continues to conduct high-level digital forensics engagements throughout the globe. Jason is also an active academic, researcher, author, speaker, advisor, and trainer. He is a member of the faculty of the SANS Technology Institute. He teaches digital forensics, and is a course author, for the SANS Institute, and has taught digital forensics to some of the leading law enforcement agencies, intelligence services, and military units in the world, including the FBI, US Secret Service, London Metropolitan Police, UK National Crime Agency, US Special Operations Command, Australian Air Force, the German Army, and more. He is actively involved in mentoring law enforcement digital forensic practitioners as a member of IACIS. His author has been published in several peer reviewed journals, with his recent research focusing on quality assurance in digital forensics. Jason is also a co-author and contributing author to several books. He is a member of the Advisory Board for the University of Pretoria, the SANS Institute, and served as an advisor to the South African Deputy Minister of Justice for the development of the South African Cyber Crime Act.

Bridging the gap between DF and IR with new capabilities in Magnet Axiom Cyber, Magnet Griffeye & officer wellness in CSAM investigations

Jeff Rutherford was a Supervisory Special Agent with the Federal Bureau of Investigation with experience in Organized Crime, Crimes Against Children, Counter Terrorism and Cyber related investigations. Jeff joined the FBI in 2003, retiring in 2024. Jeff achieved specialized certification as a Technically Trained Agent and an FBI Certified Digital Forensic Examiner. Jeff holds certifications from IACIS (CFCE) and SANS (GCFA). Jeff has testified in both State and Federal courts.

Capture The Flag workshop: tips for competing in the Magnet Virtual Summit CTF with hands-on practice, Capture the flagcChallenge

Jessica Hyde is an experienced forensic examiner in both the government and commercial sectors. She is the founder of Hexordia and an Adjunct Professor teaching Mobile Forensics in the Digital Forensics graduate program at George Mason University, where she achieved an MS in Computer Forensics. She is also involved in several community efforts including Associate Editor for the Forensic Science International: Digital Investigations Journal, Chair of DFIR Review, 2nd VP on the International Executive Committee of the High Tech Crime Investigation Association, and advisory board for Cyber Sleuths Lab. Her previous roles include Director of Forensics at Magnet Forensics, Senior Mobile Exploitation Analyst for Basis Technology, Senior at EY, and Senior Electrical Engineer at American Systems. Jessica is also proud to be a veteran of the United States Marine Corps.

Challenges conquered: Practical advice for approaching complex technical investigations

Jessica is a veteran practitioner of digital forensics with an extensive record of involvement in complex civil and criminal cases. Over the course of her 20+ year career, Jessica has provided expert testimony and performed forensic analyses of digital media in many challenging cases. She has evaluated obstructive deletion activity in securities fraud cases, covertly acquired and analyzed media in cases involving theft of intellectual property, and identified and reconstructed deleted, fragmented digital DNA files relevant to a multiple homicide investigation and death penalty trial. Jessica currently serves as the Cofounder & COO of Aletheian Labs, a boutique digital forensics consulting firm. Prior to founding Aletheian Labs, Jessica was a Vice President at Palo Alto Networks’ Unit 42, where she led consulting operations globally and built and led the consulting team responsible for client delivery in the areas of digital forensics, incident response, and proactive services. Jessica was also previously a managing director of digital forensics at Stroz Friedberg, where she was responsible for comanaging the firm’s technical operations and leading and executing large and complex digital forensics engagements.

The DFIR triad: leveraging SaaS, AI and automation, Customer story: driving efficiency with SaaS-based forensics in Magnet Nexus

Managing Director Joe Pochron of the Digital Forensics & Cyber Risk practice previously led the digital forensic and insider threat teams for the Forensic & Integrity Service Practice at a Big Four accounting firm. He has managed a global digital forensic team at a leading litigation support provider and served as cybercrime task force leader and commanding officer of a government digital forensic laboratory. With over 20 years of experience in digital forensics, eDiscovery, and cyber incident response, Joe has expertise in insider threat and complex cybercrime investigations. Joe has investigated or managed thousands of cases involving the collection and analysis of computer, mobile device, network, and cloud-based data. He has testified numerous times as a digital forensic expert on the local, state, and federal level and he frequently provides clients expert affidavits or expert forensic reports in support of their cyber investigative needs.

Tackling Hyperlinked Files in M365, Google and Slack and the Impact on Digital Investigations

Julie Lewis, President, CEO and Founder of Digital Mountain, has over 30 years of experience working in the high technology industry and has been a long-time user of social media. One of the key focus areas of her company is on social media investigations, preservations and monitoring. Prior to founding Digital Mountain, Julie worked at VERITAS Software with next-generation storage, security and search companies. At VERITAS, she managed operations for new product releases across sales, marketing, product management, legal, engineering and customer support. Before joining VERITAS, Julie worked in the venture capital and investment banking industries in both the Silicon Valley and Boston areas focusing on the Internet Infrastructure, security and software sectors.

In addition, Julie worked for two of the Big 4 accounting firms doing financial and IT auditing, as well as M&A due diligence as a CPA. She also worked for Applied Magnetics, a publicly traded provider of disk and tape drive components. Julie earned an MBA under fellowship from the F.W. Olin Graduate School of Business at Babson College and a BA in both Business Economics and Sociology from the University of California at Santa Barbara. She is a member of the High Tech Crime Investigation Association (HTCIA), American Bar Association, Sedona Conference’s Working Groups on E-mail Management and Archiving (WG1) and Data Security and Privacy Liability (WG11), Cloud Security Alliance and has received her EnCE (Encase Certification in Computer Forensics). Julie is founding Director of the Silicon Valley Chapter of Women in eDiscovery and co-author of “The Sedona Conference Primer on Social Media.

Magnet Witness: evolving video acquisition and analysis for witness

Kate Woolley is a Technical Forensic Specialist at Magnet Forensics, bringing 18 years of law enforcement experience from her work with the Vancouver Police Department and Royal Canadian Mounted Police. A LEVA Certified Forensic Video Analyst, Kate’s expertise lies in the forensic examination of multimedia evidence and investigations. In her new role, she collaborates with the Magnet WITNESS team to enhance program capabilities. Known for her commitment to mentorship and keen interest in forensic technology, Kate is passionate about developing solutions that empower investigative professionals and support public safety

Dark web investigations

Keven Hendricks is a law enforcement veteran with almost two decades experience, previously serving as a task force officer for two separate federal agencies. He is a published author with the FBI Law Enforcement Bulletin and American Police Beat and currently works as an instructor for various police training agencies, teaching a class for law enforcement on dark web and cyber crime investigations.

He is a Certified Cyber Crime Examiner and Certified Cyber Crime Investigator by the National White Collar Crime Center, a Certified Cryptocurrency Investigator through the Blockchain Intelligence Group, and a Certified Digital Asset Professional through the Global Digital Asset & Cryptocurrency Alliance. He is the founder of the Ubivis Project – StopDarkwebDrugs.com and has spoken at Conferences all over the world.

The Magnet Job: Magnet Forensics mobile solutions  

Kevin Chandler is a Solutions Consultant at Magnet Forensics with over 26 years in Law Enforcement, specializing in digital forensics and cell site analysis. Prior to joining Magnet Forensics, and before that Grayshift, Kevin worked for the British Transport Police, in various policing roles, the last 16 years were as a Detective specializing in fraud and digital investigations.

To cloud or not to cloud—that is the question

Kevin Davis is a former Sergeant with the Bedford County Sheriff’s Office and served as the lead digital forensics examiner during his time there. After leaving the Sheriff’s Office, Kevin pursued an I.T. Career with a focus on building, securing, and managing DoD Cloud Enclaves at CloudFit Software.

Challenges conquered: Practical advice for approaching complex technical investigations

Kevin is a seasoned digital forensics expert with over 25 years of experience in digital forensics and information technology, helping clients solve challenging and business-critical legal and technology issues. Kevin has extensive experience leading civil, criminal, and regulatory matters, as well as internal investigations, relating to theft or misappropriation of trade secrets, loss of data under legal hold, document authentication, and computer hardware forensics and data recovery, among others. Kevin has prepared affidavits, expert reports, and offered oral testimony in depositions, hearings, and as an expert witness in state and federal courts throughout the USA. Kevin currently serves as the Cofounder & CTO of Aletheian Labs, a boutique digital forensics consulting firm. Prior to founding Aletheian Labs, Kevin was a Vice President at Palo Alto Networks’ Unit 42, where he led and testified in their most challenging digital forensics cases. Kevin also previously held leadership positions at Stroz Friedberg (where he led the Digital Forensics and Incident Response practice), Mesirow Financial Consulting, and Protiviti.

Randy & me: a prosecutor's story of his childhood sexual abuse

Kevin Mulcahy is a survivor of child sexual abuse. He is a former federal prosecutor in Detroit who spent his career prosecuting a variety of cases, including offenses involving firearms, drugs, bank robberies, threats, terrorism, and a wide variety of other federal prosecutions. But most of his caseload focused on child exploitation crimes, including production of child sexual assault cases, traveler cases, and other significant crimes against children’s prosecutions. Kevin has been a prosecutor since 2002, all on the federal level, with the first 3 1/2 years as an AUSA in San Diego, and the rest in Detroit.

Capture The Flag workshop: tips for competing in the Magnet Virtual Summit CTF with hands-on practice

Kevin Pagano is a digital forensics analyst, researcher, blogger and contributor to the open-source community. He holds a Bachelor of Science in Computer Forensics from Bloomsburg University of Pennsylvania and a Graduate Certificate in Digital Forensics from Champlain College. Kevin is a member of the GIAC Advisory Board and holds several industry certifications, including the GIAC Advanced Smartphone Forensics (GASF), GIAC Certified Forensic Examiner (GCFE), and GIAC Battlefield Forensics and Acquisition (GBFA), and the Certified Cellebrite Mobile Examiner (CCME) among others. Kevin is the creator of the Forensics StartMe page and regularly shares his research on his blog stark4n6.com. He is a published author with multiple peer-reviewed papers accepted through DFIR Review. Kevin also contributes to multiple open-source projects, including but not limited to ALEAPP, iLEAPP, RLEAPP, CLEAPP and KAPE. Kevin is a regular competitor in the digital forensics CTF circuit. He has multiple first place finishes in competitions hosted by SANS, Magnet, Belkasoft, BloomCon and more. In his spare time, Kevin likes to drink beers and design DFIR-themed designs for stickers, clothing, and other swag. You can find him lurking on Twitter and on the DFIR Discord.

Sysdiagnose Logs 101

Kim Bradley retired from the Kentucky State Police where she worked the last nine years of her career as a Forensic Computer Examiner. She was assigned to the Federal Bureau of Investigation’s Cyber Crime Task Force and worked for five years at the Kentucky Regional Forensics Laboratory (KRCFL). Kim is an adjunct instructor at Eastern Kentucky University teaching Digital Forensics and Cybercrime. Her previous roles included Forensic Consultant and Forensic Trainer at Magnet Forensics and Digital Forensics Lead at Orbital Data Consulting. In addition to holding several certifications, Kim has a Bachelors degree in Computer Science and a Master of Science degree in Digital Forensic Science.

Where's the bot - a look at Android anti-forensics

Matt is a currently a Forensics Trainer for Magnet Forensics, a specialist in teaching a wide range of disciplines including mobile, cloud and Mac forensics. Matt’s previous roles include working for various UK law enforcement agencies, investigating a multitude of different crime types including high level organised crime, murder, fraud and child sexual exploitation. Before joining Magnet Forensics, Matt was a lecturer at Teesside University, where he taught digital forensics and cyber security at both an undergraduate and postgraduate level. Matt enjoys sharing and imparting knowledge wherever possible and enabling others to do their roles to the best of their ability.

Hunting for cryptocurrency

Matt has over ten years of experience in digital forensics within UK law enforcement. He began his career at the Metropolitan Police Service, moving from police officer to detective, and then into digital forensics. Now he works at the Yorkshire and Humber Regional Organised Crime Unit (YHROCU).

Matt’s role has included managing digital investigations, attending scenes, conducting interviews, executing Technical Equipment Interference (TEI) warrants and recovering digital evidence. His work has involved securing millions in cryptocurrency and cracking encrypted data in complex cases. In court, he has provided testimony to clarify digital findings and explain technical concepts.

Simplified eDiscovery: exploring efficient data collection, culling, and sharing with Magnet Axiom Cyber and Magnet Verakey

Mel Hungate is a Senior Product Manager at Magnet Forensics, leading Axiom Cyber. Previously, she worked on Axiom Examine, Data Analytics, and Artifacts within Magnet. With a background in computer engineering, Mel has also managed products in the insurance and ecommerce industries, but finds digital forensics to be her favorite area yet! Outside of work, she enjoys playing ultimate frisbee, exploring local thrift shops, and spending hours crafting what she could probably just buy for under ten dollars.

Addressing mobile backlogs and bottlenecks with Magnet Forensics

Michael Cox joined Magnet Forensics Product Marketing team in Feb of 2023, supporting the company’s public safety portfolio and currently manages the product marketing development for Magnet Graykey, Graykey Fastrak, Axiom and Outrider. Michael has over 15 years of experience contributing to marketing and product marketing for global hardware and software solution providers.

Keeping secrets within hidden/locked mobile apps

Preston McNair is a Senior Forensics Trainer for Magnet Forensics where you can find him enthusiastically delivering content on mobile operating systems. Prior to Magnet, Preston had a varied background in law enforcement-based investigations. This includes working for the State of West Virginia as a Digital Forensic Examiner, where he established a digital forensics laboratory focused on narcotics and violent crime related investigations for all levels of government. Outside the classroom, his research efforts primarily focus on everything mobile and the general Apple ecosystem.

Bringing DFIR to the table: aligning digital forensics with cybersecurity strategies

Dr. Stephen Boyce currently serves as the Director of the Magnet Digital Investigation Suite (MDIS) at Magnet Forensics, where he provides strategic direction to internal and external stakeholders on modernizing digital investigations and managing human and cyber risk.

The Magnet Job: Magnet Forensics mobile solutions   

Stephen Coates is a Manager of the Solutions Consultants at Magnet Forensics and a subject matter expert in Mobile Forensics. Prior to joining Grayshift and then Magnet Forensics, Stephen’s background for the over 32 years was in Law Enforcement, serving with the Royal Military Police, Royal Ulster Constabulary GC and the Police Service of Northern Ireland. During that time since 2005 he has been a Digital Forensics practitioner starting with Computer Forensics and then specialising in the extraction and analysis of mobile devices, assisting investigations involving serious crime and terrorism. During that time Stephen was also an associate trainer/instructor for Mobile Digital Forensics at the UK College of Policing and was also responsible for delivering all Mobile Device training within the Police Service of Northern Ireland since 2009.

Customer story: driving efficiency with SaaS-based forensics in Magnet Nexus

Tayfun joined Magnet Forensics in 2011 with a background in software engineering and business. He’s held various leadership positions within engineering and product management and has led the development of many of Magnet Forensics DFIR products. He holds an Honors Bachelor of Applied Science degree from the University of Waterloo and holds a number of patents within DFIR. He is currently Director, Product focused on the Magnet IGNITE product.

Bing, Yandex and encoded URLs

Sergeant Timothy Wooten holds dual Bachelor of Fine Arts degrees from Louisiana Tech University, specializing in Communication Design and Photography, and a Master of Science in Digital Forensic Investigation from the University of New Haven. He is highly credentialed, with ten certifications in digital forensics, two in cybercrime investigations, and one in cybercrime intelligence. Over his career, he has completed extensive law enforcement training and investigated a wide range of crimes, including property crime, white-collar crime, sexual abuse, child exploitation, and homicides.

As a Deputy, Sergeant Wooten has written, executed, and assisted in hundreds of search warrants. His expertise in digital forensics has led him to certify and testify as an expert witness in Court, particularly in digital forensic examinations and historical cell phone data analysis. Additionally, he is an active member of both the Louisiana ICAC Task Force and the United States Secret Service Southwest Louisiana Cyber Fraud Task Force.

Key artifacts in child abduction/enticement cases

SA Tom Thompson has been a Special Agent with the Federal Bureau of Investigation (FBI) for 20 years. SA Thompson worked crimes against children violations for seventeen years and is currently the Digital Threat Coordinator for the New York Division and oversees NY’s Criminal Division’s Digital Forensic Laboratory. SA Thompson is a member of the FBI’s Child Abduction Rapid Deployment (CARD) team and he is on the New York State Missing Person Cold Case Review Panel. He is also an FBI certified Digital Extraction Technician and a SANS mobile cell phone forensic examiner.

Simplified digital investigations for evolving business needs

Trey Amick is a forensics investigator with a background in both law enforcement and corporate investigations. As a detective with the Rock Hill Police Department in South Carolina, Trey was sworn as a Special Deputy United States Marshal and supported the US Secret Service Electronic Crimes Task Force. Previously, he served in roles in both Patrol and Professional Standards.

Most recently, as a corporate investigator, Trey managed the Enterprise Cyber Education and Awareness Team at Capital One, where he also served as part of the Cyber Technical Investigations Team. Trey is currently the Director of the Forensic Consultants at Magnet Forensics, where he assists in the development of Magnet AXIOM and AXIOM Cyber and provides skilled support to customers with his combined knowledge of Magnet’s tools and digital forensics.

Tackling the data management challenge with cloud

Tyler Schlecht is an experienced start-up leader and strategic product innovator with over 10 years of expertise in launching and scaling new products. He was the founding employee and co-owner of DME Forensics, a company specializing in video forensics software, which was later acquired by Magnet Forensics. Tyler played a key role in developing DVR Examiner, a groundbreaking software solution that simplifies the process of extracting video from surveillance DVRs, enabling investigators to access hard drives directly and efficiently.
Currently, Tyler serves as the Senior Director of Platform Strategy at Magnet Forensics, where he leads product strategy and development for Magnet One. Prior to this, he was the Senior Director of Product for Video Forensics at Magnet Forensics, overseeing strategic planning and product management initiatives.

Utilizing blockchain analytics to seize crypto

William is a former United States Marine where he worked as a communications specialist for six years before joining Chainalysis’ National Security Programs. He went on to lead intelligence operations, was a senior investigator, and an expert witness at Cipherblade before joining Heights Labs where he explores use cases and provides support for the DoD, DHS, and state and local law enforcement customers.

He currently is the Team co-lead of the Law Enforcement working group of Operation Shamrock which is a coalition of private sector and law enforcement agencies that combat “Pig Butchering” scams. He leads a team of 20+ law enforcement investigators who proactively investigate and follow the flow of funds on the blockchain. William additionally writes and contributes as a junior analyst for the Military Operations
Research Society (MORS) and is a part of Interpol Innovation Centers 9th Digital Forensics Expert Group.

Forensic investigation and data protection

Wishnu is a seasoned digital forensics and IT audit specialist with 15 years of extensive experience in the field. Serving in the tax audit and investigation at the Ministry of Finance in Indonesia, his role is handling digital evidence for tax-related investigations, ensuring the integrity and admissibility of electronic data in legal proceedings. His expertise spans across complex digital investigations, evidence preservation, and the development of standardized forensic procedures in financial investigations.
As a CISA, CHFI, CPM, DPO certified specialist, with other relevant training and credentials, he brings a comprehensive blend of technical expertise and strategic insight to the work. His certifications reflect his commitment to maintaining the highest standards in information systems auditing and digital forensics. This combination of credentials enables him to approach investigations with both technical precision and strategic oversight, ensuring thorough and reliable results in complex cases.
He is currently conducting research on digital forensics and data privacy at the Institute of Science Tokyo -known as Tokyo Institute of Technology- focusing on automation technology and social acceptance of digital forensics and their impact on investigative methodologies. This research emphasizes the importance of balancing technological advancement with practical application in real-world scenarios. Through his research, he explores innovative approaches to digital forensics that could enhance the efficiency and effectiveness of investigative processes while maintaining public trust.
As an active member of several professional organizations, including the ACFE, ISACA, Japan Law Network Society, Asian Law and Society, and EC-Council, he maintains strong connections within the global forensics and cybersecurity community. He regularly contributes to the field through journal publications and frequently shares his expertise as a speaker at academic conferences and professional meetings, bridging the gap between theoretical advancement and real-world implementation in digital forensics.