IMF 2017

Conference Background

This year brings together two premier research conferences in Europe, the DFRWS digital forensics conference (DFRWS EU 2017) and the International Conference on IT Security Incident Management & IT Forensics (IMF 2017).

See also the content of the DFRWS Europe 2017 webpage

Established in 2001, DFRWS has become the premier digital forensics conference, dedicated to solving real world challenges, and pushing the envelope of what is currently possible in digital forensics.

Since 2003, IMF has established itself as one of the premier venues for presenting research on IT security incident response and management and IT forensics. While the first IMF conference was organized to establish a research forum for German speaking researchers and practitioners from the field, it soon became an International conference attracting many experts across Europe. IMF 2017, being the 10th Conference, is also an important mile stone in bringing the two worlds of IT security incident response and management and forensics together.

Both DFRWS and IMF organise informal collaborative environments each year that bring together leading researchers, practitioners, industry, tool developers, academics, law enforcement, and other government bodies from around the globe to tackle current and emerging challenges in their fields.

The co-hosting of the two events will help generate new discussions and ideas by bringing together two strong research communities: DFRWS’s community encompassing a broad range of topics in digital forensics, and IMF’s community focusing on IT security incident response and management.

The proceedings of DFRWS EU / IMF 2017 will be published in a special open-access issue of Elsevier's Digital Investigation journal, and will be freely available on the DFRWS website.

Conference Goals / Possibilities to contribute

IMF's intent is to gather experts from throughout the world in order to present and discuss recent technical and methodical advances in the fields of IT security incident response and management and IT forensics. The conference provides a platform for collaboration and exchange of ideas between industry, academia, law-enforcement and other government bodies.

In recent years, DFRWS and IMF conferences have added practitioner presentations and hands-on tutorials/workshops taught by leading experts in the fields. Presentations are opportunities for industry researchers and practitioners who do not have the time to write a paper, but who have forensics information and experiences that would be of interest to DFRWS / IMF attendees. Presentation proposals undergo a light reviewing process to filter out sales pitches and ensure the topic is relevant to our audience.

We invite original contributions as research papers, non-research practitioner presentations, tutorials/workshops, panels, demos, and posters on the following topics in digital forensics and IT security incident response and management:

Conference Topics

The scope of IMF 2015 is broad and includes, but is not limited to the following areas:

IT Security Incident Management

• Incident management standardization, metrics and life cycle
• Incident management formats and protocols
• Incident response and/or Vulnerability response workflows, procedure and tools
• Incident analysis including live analysis
• Research in incident management and related processes
• Development of tools supporting incident management processes
• Exchange of cyber threat intelligence
• Exchange of cyber threat intelligence
• Setup of cyber defense entities including but not limited to: CSIRTs, PSIRTs, ISACs, SOCs and any other organization specialising in (some) IT security incident management processes
• Maturity of such cyber defense entities
• Warning of large scale communities about upcoming threats or detected vulnerabilities
• Ensuring situational awareness and early warning
• Mandatory vs. discretionary attack / incident / vulnerability reporting
• Non-traditional incident management scenarios and approaches (e.g. vehicles, control systems, and SCADA)

IT Forensics

• "Big data" approaches to forensics, including data collection, data mining, and large scale visualization
• Research and development of tools supporting digital forensics
• Digital forensic laboratories and other organizations specialising in digital forensic science
• Addressing forensic challenges of systems-on-a-chip
• Anti-forensics and anti-anti-forensics
• Bridging the gap between analog and digital traces/evidence/investigators
• Case studies and trend reports
• Data hiding and discovery
• Data recovery and reconstruction
• Database forensics
• Digital evidence and the law
• Digital evidence storage and preservation
• Digital evidence and open source intelligence analysis
• Event reconstruction methods and tools
• Impact of digital forensics on forensic science
• Interpersonal communications and social network analysis
• Malware and targeted attacks: analysis, attribution
• Memory analysis and snapshot acquisition
• Mobile and embedded device forensics
• Multimedia forensic analysis
• Network and distributed system forensics
• Non-traditional forensic scenarios and approaches (e.g. vehicles, control systems, and SCADA)
• Storage forensics, including file system and Flash
• Tool testing and development
• Triage, prioritization, automation: efficiently processing large amounts of data in digital forensics
• Typology of digital traces
• Virtualized environment forensics, with specific attention to the cloud and virtual machine introspection

The above list is only suggestive. We welcome new, original ideas from people in academia, industry, government, and law enforcement who are interested in sharing their results, knowledge, and experience. Authors are encouraged to demonstrate the applicability of their work to practical issues. Questions about submission topics can be sent via email to: eu-papers dfrws org

Submissions

Research papers

Research papers must be original contributions, not duplicate previous work (including the authors' own), and must not be under simultaneous publication review elsewhere. The review process will be "double-blind" (reviewers will not know who the authors are, and authors will not know who the reviewers are). Therefore, the version submitted for review should not contain the names or affiliations of the authors. When referring to their own previous work, authors should use the third person instead of the first person (i.e. "Smith and Jones [2] previously determined..." instead of "We [2] previously determined...").

Papers must be written in English and should not exceed 10 single-spaced, two-column pages with 1 inch margins and 10pt font. Papers should be submitted as PDF files. Accepted papers will be required to utilize the provided Microsoft Word template or Elsevier's LaTeX template (elsarticle class with the "5p" option). Authors are encouraged to use these templates for the submission version as well. After using the templates, do not forget to remove authors' names and other revealing information for double-blind submission.

Authors are expected to present their work in person at the conference. At least one registration per paper is required in order to be included in the proceedings. Authors shall register for the conference prior to submitting their final draft for publication. At the conference, authors of accepted papers will be given 25 minutes to present their work, followed by 5 minutes of questions.

Research papers must be submitted through the EasyChair site at https://easychair.org/conferences/?conf=dfrwseu2017.
Submissions must be in Adobe Acrobat PDF format. Send any questions about research paper submissions to eu-papers (at) dfrws (dot) org.

Panel proposals

These should be one to three pages and clearly describe the topic, its relevance, and a list of potential panelists and their biographies. Panels will be evaluated based on the topic relevance and diversity of the panelists.

Panel proposals must be emailed to eu-panels (at) dfrws (dot) org in PDF or plain text format.

Non-Research practitioner presentation

DFRWS EU / IMF 2017 is soliciting proposals for 15-minute presentations that showcase forensics experiences of interest to DFRWS attendees, including (but not limited to) case studies and advances in user interface, real-time analysis, and triage. Presentation proposals are not included in the printed proceedings and should not be anonymized. Presentation proposals only undergo a light reviewing process to make sure they are of interest to the community. Sales pitches will not be accepted. Presentation proposals are in the form of an abstract (150-300 words) in PDF format. At least one author is expected to register and present their work in person at the conference. Presenters will be given 15 minutes, followed by 5 minutes of questions. Presentation duration will be strictly enforced.

Presentation proposals must be submitted through the EasyChair site at https://easychair.org/conferences/?conf=dfrwseu2017.
Submissions must be in Adobe Acrobat PDF format. Send any questions about presentation proposal submissions to eu-papers (at) dfrws (dot) org.

Demo or poster proposals

DFRWS EU / IMF 2017 welcomes demonstrations or posters of proof of concept and research-based tools. Proposals should describe the tool, its relevance to the forensics field, and space/equipment needs (e.g., table size, power, networking, etc.).

Demo or poster proposals must be emailed to eu-demos (at) dfrws (dot) org in PDF or plain text format.

Workshop proposals

DFRWS EU / IMF 2017 offers an expanded opportunity to present half-day or full-day workshops and vendor-agnostic tutorial sessions.

Tutorial/workshop proposals must be emailed to eu-workshops (at) dfrws (dot) org in PDF or plain text format.

Lightning talks

Conference attendees are invited to present parts of their ongoing work or open research questions for 5 minutes. Registration for lightning talks is possible at the conference.

Student award and student scholarship program

DFRWS continues its outreach to students studying digital forensics. This year DFRWS will be offering an award with a cash prize to the best student paper. A student paper is any paper in which the majority of the work was performed and the paper written by full-time students at an accredited university, college, or high school.

A limited number of scholarships may be awarded to students presenting a paper at the conference. The intent is to help alleviate the financial burden due to the cost of hotel expenses and conference registration.

Click here for proposal requirements

Dates and Deadlines (for regular papers and special sessions)

Papers/Presentations/Panel Proposals Submission:	October 3, 2016
Workshop/Tutorials Proposals Submission:	October 23, 2016
Papers/Presentations/Panel Proposals Notification:	December 18, 2016
Demo/Poster Proposals Submission:	January 15, 2017
Final Paper Draft and Presenter Registration:	January 22, 2017