Atola Technology

Top forensic conferences 2018-2019

Event season 2018 has already begun! With this post, we want to start the list of the most prominent worldwide events in digital forensics. If you want to keep up to date with the exhibitions and conferences organized around the globe, save this link and check this page later: we are going to update the list as we receive info on new events and get the dates of the already planned ones confirmed.

The digital forensic conferences, at which Atola Technology will be exhibiting, are marked with asterisk (*).

last updated April 14, 2018

Conference Date Location Region Registration fee
IFIP Working Group 11.9 on Digital Forensics January 3 – 5 New Delhi, India Asia Pacific $290
CyberTech Israel January 29 – 31 Tel Aviv, Israel Middle East €575
21st European Police Congress * February 6 – 7 Berlin, Germany Europe €895
West 2018 February 6 – 8 San Diego, CA North America $625
NSA Winter Legislative & Technology Conference February 10 – 13 Washington D.C. North America unknown
70th Annual Scientific Meeting February 19 – 24 Seattle, WA North America $515
10th GPEC February 20 – 22 Frankfurt, Germany Europe €5
2018 CHIA Conference * February 27 – March 2 Las Vegas, NV North America $375
Mid-Atlantic Regional Gang Investigators Network March 4 – 7 Annapolis, MD North America unknown
Forensic Europe Expo * March 6 – 7 London, UK Europe free
Security & Policing 2018 March 6 – 8 Hampshire, UK Europe free
DFRWS EU 2018 March 21 – 23 Florence, Italy Europe €550
Emirates International Forensic Conference & Exhibition * April 9 – 11 Dubai, UAE Middle East AED 1,937
Forensecure 2018 April 12 – 13 Wheaton, IL North America $200
2018 Minnesota HTCIA Spring Conference April 18 – 19 Shoreview, MN North America unknown
National Cyber Crime Conference * April 23 – 25 Boston, MA North America $350
IACIS * April 23 – May 4 Orlando, FL North America $2,795
2018 Wisconsin Crimes Against Children Conference May 7 – 8 Green Bay, WI North America unknown
IMF 2018 May 7 – 9 Hamburg, Germany Europe unknown
International Police Expo * May 10 – 11 New Delhi, India Asia Pacific unknown
Ontario Forensic Investigators Association * May 15 – 17 Niagara Falls, ON, Canada North America $400
China International Exhibition on Police Equipment May 15 – 18 Beijing, China Asia Pacific unknown
ADFSL Conference May 17 – 18 San Antonio, TX North America $248
IACP Technology Conference May 21 – 23 Providence, RI North America $750
Enfuse * May 21 – 24 Las Vegas, NV North America $1,895
Techno Security & Digital Forensics * June 3 – 6 Myrtle Beach, SC North America $1,295
DFIR Summit & Training 2018 June 7 – 14 Austin, TX North America $1,870
Eurosatory * June 11 – 15 Paris, France Europe unknown
National Law Enforcement Training on Child Exploitation June 12 – 14 Atlanta, GA North America unknown
2nd World Conference and Exhibition on Forensic Science June 11 – 12 Rome, Italy Europe $699
NSA Annual Education & Technology Expo * June 15 – 19 New Orleans, LA North America $595
ISS World South Africa  July 10 – 12 (*2016, TBC) Johannesburg, RSA Africa $1,295
18th Annual DFRWS USA 2018 July 15 – 18 Providence, RI North America $800
WCSF 2018 August 1 – 3 New York, NY North America unknown
Crimes Against Children Conference *  August 6 – 10 Dallas, TX North America $600
113th CACP Annual Conference August 12 – 15 Halifax, NS, Canada North America $795
HTCIA International Conference & Training Expo * August 20 – 22 Washington, D.C. North America unknown
Youth, Technology & Virtual Communities Conference August 27 – 29 Gold Coast, Australia Asia Pacific unknown
PFIC September 5 – 6 Park City, UT North America $399
ANZFSS 24th International Symposium on Forensic Science September 9 – 13 Perth, Australia Asia Pacific $1,700.00
ICDFJS 2018 September 10 – 11 Tokyo, Japan Asia Pacific €450
ICDF2C * September 10 – 12 New Orleans, LA North America €843
Techno Security & Digital Forensics West * September 17 – 19 San Antonio, TX North America unknown
I.A.C.P. * October 6 – 9 Orlando, FL North America $725
2018 Northwest Regional ICAC Conference October 10 – 12 Redmond, WA North America unknown
OSDFCon October 17 Herndon, VA North America unknown
O.P.P. Strategy * October 22-25 Niagara Falls, ON, Canada North America $200
Milipol Qatar October 29 – 31 Doha, Qatar Middle East unknown
GCC * October 31 – November 3 Abu Dhabi, UAE Middle East AED 1833
Forensic Europe Expo * March 8 – 9, 2019 London, UK Europe free
Techno Security & Digital Forensics West Coast March 11 – 13, 2019 San Diego, CA North America unknown
Milipol Asia Pacific 2019 April 2 – 4, 2019 Marina Bay Sands, Singapore Asia Pacific unknown
3rd World Conference and Exhibition on Forensic Science June 3 – 4, 2019 Berlin, Germany Europe $899
Israel Defence and HLS Expo 2019 June 4 – 6, 2019 Tel Aviv, Israel Middle East unknown
Milipol 2019 * November 19 – 22, 2019 Paris, France Europe unknown

NB The registration fees in this table are indicative. Each conference has a range of fees based on the occupation, the country of origin or the role of each participant. Therefore we mention only the basic rate which does not include discounts or special offers. Please check the websites of forensic conferences to learn more about the applicable registration rates.

The speed of imaging with Atola Insight Forensic

As we travel to exhibit at forensic events worldwide, we usually bring some of the fastest SSDs (usually Samsung 850 Pro) with us to show the speed at which they can be imaged with Atola Insight Forensic (on these drives, it constitutes around 500 MB/s).

At the same time, we feel that in this blog we have missed the opportunity to demonstrate exactly how fast Insight can image different types of hard drives, solid-state drives, USB flash memory, etc.

We test our units on a wide range of storage devices. This time we imaged a few of them and cross-checked the speed with userbenchmark.com, where you can find detailed info on the minimum, average and maximum read and write speed of almost every data storage device in the market.

NB. Imaging speed is limited by the speed of the slowest of the devices participating in the imaging session. Therefore, the slowest of the two speeds (either the read speed of the source or the write speed of the target) will define the speed at which imaging process is running.

Samsung 850 Pro 256GB

We begin with the Samsung 850 Pro SSDs mentioned above. These two drives are not damaged but are rather worn out, as we have been demonstrating Insight’s imaging speed on them at every exhibition for a few years now. Insight images from one such SSD to another at 501 MB/s (therefore it is the write speed of the target drive that defines the imaging speed in this case).

At userbenchmark.com this drive’s maximum write speed in sequential mode (sectors read and written to in sequential order) is 502 MB/s.

Samsung 850 Pro 128GB

Next, we take the 128 GB version of the same SSD drive, and Insight images it at 490 MB/s.

The maximum write rate (we image to an identical SSD) claimed at userbenchmark.com (based on over 6 thousand samples) is 490 MB/s, the same rate as that achieved by Insight.

Toshiba X300 4TB

When Insight images a 4TB Toshiba X300 (an HDD with SATA interface), it achieves the speed of 195 MB/s.

How does this speed compare to the one at userbenchmark.com? The website quotes 182 MB/s of max read speed. Insight’s speed substantially exceeded the benchmark speed based on 992 samples!

Western Digital’s Blue 250 GB (2008)

Insight’s speed of imaging a Western Digital’s Blue 250 GB constituted 115 MB/s.

At userbenchmark.com the same drive’s max read speed is 115 MB/s. Again Insight achieved the top speed based on over 3000 samples.

Western Digital WD7500AYPS 750GB

Insight was able to reach 77 Mb/s when reading WD7500AYPS 750GB drive.

The same drive at userbenchmark.com achieved the maximum read speed of 73.7 MB/s. Again Insight exceeds this index.

HGST HTS41010A9E680 1TB

When imaging this HGST 1TB SAS hard drive, Insight was able to achieve 111 MB/s.

And it is a much higher speed than that of userbenchmark.com (99.5 MB/s max read speed).

Corsair Voyager 3.0 64GB

Next, we imaged Corsair Voyager 3.0 64GB USB, and Insight reached an overall speed of 207 MB/s.

The max read speed achieved by the contributors of userbenchmark.com constituted 215 MB/s. Insight did below the max speed but substantially above the average.

Speed has always been the cornerstone of our development efforts. And we are pleased to confirm that Insight does exceptionally well when imaging most data storage devices.

Please note that here we imaged devices that were in overall good health. Imaging may be considerably slower when dealing with a damaged drive, and the speed heavily depends on the type and degree of such damage.

 

Here are links to the userbenchmark.com pages with the devices mentioned in this blog for your reference:

Samsung 850 Pro 256GB http://ssd.userbenchmark.com/Samsung-850-Pro-256GB/Rating/2385

Samsung 850 Pro 128GB http://ssd.userbenchmark.com/Samsung-850-Pro-128GB/Rating/3483

Toshiba X300 4TB http://hdd.userbenchmark.com/Toshiba-X300-4TB/Rating/3592

WD Blue WD2500AAKS 250GB http://hdd.userbenchmark.com/SpeedTest/2143/WDC-WD2500AAKS-00L6A0

WD WD7500AYPS-01ZKB0 750GB http://hdd.userbenchmark.com/SpeedTest/7309/WDC-WD7500AYPS-01ZKB0

HGST Travelstar 5K1000 2.5″ 1TB http://hdd.userbenchmark.com/SpeedTest/72/HGST-HTS541010A9E680

Corsair Voyager GT 3.0 64GB http://usb.userbenchmark.com/SpeedTest/5886/Corsair-Voyager-GT-30

Evidence acquisition workflow in 5 steps

For more information please read about the suggested workflow and hashing during imaging.

Artifacts: Image & analyze on the fly

Imaging is a time-consuming part of the evidence acquisition process, especially when dealing with damaged drives.

Even though Atola Insight Forensic is the fastest forensic imaging tool in the world (there is literally no penalty on a drive speed when you image it with Insight!), we want to help expedite forensic process even further. That is why our team of engineers has developed the artifact search feature, which allows analysis of data from an evidence device during imaging.

Artifacts settings

1. Go to Imaging category of the left-side menu
2. Click Create new session link and select the target device
3. In Preset line click Show settings link
4. Open the Artifacts tab.

In this tab it is possible to view, select or deselect the artifacts you want to be searched in the course of imaging.

For each of these artifacts we have not only applied well-known algorithms including the Luhn formula used to validate credit card numbers, but also applied our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).

Keywords and regular expressions can be added to the search parameters in a txt file with one artifact per line. Click the View link next to Keywords category in Artifacts tab before imaging and make sure the keywords are displayed correctly. Keyword encoding can be adjusted to Unicode, Unicode (UTF-8), Unicode (Big-Endian) or US-ASCII.

A few of the artifacts are selected by default, namely: GPS, MAC, Phone numbers, URL. You can adjust these default settings and click Save settings button. This will affect all future imaging sessions (including those on new source drives) unless you re-adjust the settings or restore the default settings by clicking the corresponding link. The paths to the files with keywords and regular expressions will also remain saved, although should any changes by made to the txt files in the saved directory, the changes will be uploaded at the start of each imaging session.

NB. It is advisable that no more than 4 artifacts are selected at a time, otherwise imaging will slow down considerably. Also, keywords consisting of less than 4 symbols or regular expressions consisting of less than 6 symbols; large number of keywords (more than 2000) or regular expressions (more than 10) may also slow down imaging process. This is due to the large number of results such search parameters are capable of producing.

Once you have ticked the boxes next to the artifacts you would like to be searched for, click Start Imaging button.

Browsing through the artifacts in the course of imaging

Once imaging has begun, go to the Artifacts tab in the bottom part of Insight window and watch the selected artifacts being found: the numbers of artifacts and the corresponding diagram change on the go.

To see the artifacts in a list, press on any of the categories or the diagram.

In the table, each artifact is assigned an Id number, each found Value is shown in the context (including 20 bytes before and 20 bytes after the artifact in grey color), the LBA and the offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the Search bar to find a specific value (search examples are provided in the bottom right corner of the window), filter results for unique values by clicking the Show unique artifacts link.

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive: to sort the results click Count in the table header.

To promptly find the sector where an artifact is located, you can double click the artifact you would like to examine more thoroughly.

Exporting artifacts

Export to CSV button is disabled during imaging. You can wait until imaging is completed or pause it, make an export and restart imaging, should it be necessary to start analyzing the current artifact search output with an external tool:

1. Pause imaging.
2. In the Imaging results page click on Artifacts link.
3. In the Artifacts page you can select the artifacts you would like to be exported (e.g. one or multiple artifact categories, unique artifacts or only those fitting certain search criteria), and then click Export to CSV file button.
4. Select the path for the file and click Export
5. Once the export is completed (which normally takes no longer than a few seconds), restart imaging.

There is Export artifact link now in the Imaging category of Insight’s menu. If the source drive was imaged in multiple sessions, and artifact lists were created during different imaging sessions, by clicking this link you can download a merged list of artifacts from multiple imaging sessions.

Atola Insight Forensic 4.10 – Search of forensic artifacts in the course of imaging

On December 5 Atola Technology releases Atola Insight Forensic 4.10.

The key feature is the search of artifacts capability while imaging a source evidence media. It allows to search the source drive for credit cards, emails, URLs, IPs, GPS coordinates, phone numbers, keywords etc. in the course of imaging. This feature will help forensic specialists expedite investigation in urgent cases or when dealing with a damaged drive that takes hours to image.

The full list of Atola Insight Forensic 4.10 changes can be found here: Atola Insight Forensic Changelog.

Imaging settings now have a new Artifacts tab where different types of artifacts can be selected and lists of keywords or regular expressions can be uploaded.

For each of the artifacts, we have not simply applied well-known algorithms (e.g. Luhn formula used to validate credit card numbers). We have developed our own smart filters to eliminate false results (e.g. if there are two slashes near the number that has preliminarily been identified as a credit card number, that will eliminate it from the search results, as it is likely to be a part of a URL).

We have added a new Artifacts tab in the bottom part of Insight’s imaging window: the numbers of the found artifacts and the corresponding diagram change on the go.

The list of found artifacts is opened by a click on any of the categories or the diagram itself.

In the table, each artifact’s Value is shown in the context (including 20 bytes before and 20 bytes after the artifact), the LBA and the offset are also displayed in the table to help locate the artifact.

There are many options to help find, sort, filter and view the artifacts: it is possible to view one or a few categories of artifacts in one list, use the search bar to find a specific value, filter results for unique values by clicking the Show only unique artifacts link.

The latter option is quite valuable as it helps identify the values most frequently occurring on the drive. It often accelerates the whole process of specific artifact search.

For more information about the Artifacts feature please read our next week’s blog post or follow this link to our manual:
http://atola.com/products/insight/manual

Where to buy

If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:

http://atola.com/wheretobuy/

Please contact our Atola Technology sales to receive more specific information:

P.S. Dear customers, we appreciate your feedback and will take it into account when making changes to the product. Therefore, please feel free to write your thoughts or ideas as comments below.