This year brings together two premier research conferences in Europe, the DFRWS digital forensics conference (DFRWS EU 2017) and the International Conference on IT Security Incident Management & IT Forensics (IMF 2017).

Established in 2001, DFRWS has become the premier digital forensics conference, dedicated to solving real world challenges, and pushing the envelope of what is currently possible in digital forensics.

Since 2003, IMF has established itself as one of the premier venues for presenting research on IT security incident response and management and IT forensics. While the first IMF conference was organized to establish a research forum for German speaking researchers and practitioners from the field, it soon became an International conference attracting many experts across Europe. IMF 2017, being the 10th Conference, is also an important mile stone in bringing the two worlds of IT security incident response and management and forensics together. 

Both DFRWS and IMF organise informal collaborative environments each year that bring together leading researchers, practitioners, industry, tool developers, academics, law enforcement, and other government bodies from around the globe to tackle current and emerging challenges in their fields. 

The co-hosting of the two events will help generate new discussions and ideas by bringing together two strong research communities: DFRWS’s community encompassing a broad range of topics in digital forensics, and IMF’s community focusing on IT security incident response and management.

The proceedings of DFRWS EU / IMF 2017 will be published in a special open-access issue of Elsevier's Digital Investigation journal, and will be freely available on the DFRWS website.

The DFRWS EU / IMF 2017 conference extends the 17-year tradition of research conferences organized by DFRWS.org, including the DFRWS US 2016 conference from from August 7 to 10, 2016 in Seattle. The information on the upcoming DFRWS USA, the program and how to register can be found at http://dfrws.org/2016/

Possibilities to contribute:

In recent years, DFRWS and IMF conferences have added practitioner presentations and hands-on tutorials/workshops taught by leading experts in the fields. Presentations are opportunities for industry researchers and practitioners who do not have the time to write a paper, but who have forensics information and experiences that would be of interest to DFRWS / IMF attendees. Presentation proposals undergo a light reviewing process to filter out sales pitches and ensure the topic is relevant to our audience.

We invite original contributions as research papers, non-research practitioner presentations, tutorials/workshops, panels, demos, and posters on the following topics in digital forensics and IT security incident response and management:

IT Security Incident Management

    Incident management standardization, metrics and life cycle
    Incident management formats and protocols
    Incident response and/or Vulnerability response workflows, procedures and tools
    Incident analysis including live analysis
    Research in incident management and related processes
    Development of tools supporting incident management processes
    Exchange of cyber threat intelligence
    Sharing of data/information about threats, attacks, incidents, etc.
    Setup of cyber defense entities including but not limited to: CSIRTs, PSIRTs, ISACs, SOCs and any other organization specialising in (some) IT security incident management processes  
    Maturity of such cyber defense entities
    Warning of large scale communities about upcoming threats or detected vulnerabilities
    Ensuring situational awareness and early warning
    Mandatory vs. discretionary attack / incident / vulnerability reporting
    Non-traditional incident management scenarios and approaches (e.g. vehicles, control systems, and SCADA)

Digital Forensics

    "Big data" approaches to forensics, including data collection, data mining, and large scale visualization
    Research and development of tools supporting digital forensics
    Digital forensic laboratories and other organizations specialising in digital forensic science
    Addressing forensic challenges of systems-on-a-chip
    Anti-forensics and anti-anti-forensics
    Bridging the gap between analog and digital traces/evidence/investigators
    Case studies and trend reports
    Data hiding and discovery
    Data recovery and reconstruction
    Database forensics
    Digital evidence and the law
    Digital evidence storage and preservation
    Digital evidence and open source intelligence analysis
    Event reconstruction methods and tools
    Impact of digital forensics on forensic science
    Interpersonal communications and social network analysis
    Malware and targeted attacks: analysis, attribution
    Memory analysis and snapshot acquisition
    Mobile and embedded device forensics
    Multimedia forensic analysis
    Network and distributed system forensics
    Non-traditional forensic scenarios and approaches (e.g. vehicles, control systems, and SCADA)
    Storage forensics, including file system and Flash
    Tool testing and development
    Triage, prioritization, automation: efficiently processing large amounts of data in digital forensics
    Typology of digital traces
    Virtualized environment forensics, with specific attention to the cloud and virtual machine introspection

The above list is only suggestive. We welcome new, original ideas from people in academia, industry, government, and law enforcement who are interested in sharing their results, knowledge, and experience. Authors are encouraged to demonstrate the applicability of their work to practical issues. Questions about submission topics can be sent via email to: eu-papers  dfrws  org

SUBMISSIONS

RESEARCH PAPERS: Research papers must be original contributions, not duplicate previous work (including the authors' own), and must not be under simultaneous publication review elsewhere. The review process will be "double-blind" (reviewers will not know who the authors are, and authors will not know who the reviewers are). Therefore, the version submitted for review should not contain the names or affiliations of the authors. When referring to their own previous work, authors should use the third person instead of the first person (i.e. "Smith and Jones [2] previously determined..." instead of "We [2] previously determined..."). 

Papers must be written in English and should not exceed 10 single-spaced, two-column pages with 1 inch margins and 10pt font. Papers should be submitted as PDF files. Accepted papers will be required to utilize the provided Microsoft Word template or Elsevier's LaTeX template (elsarticle class with the "5p" option). Authors are encouraged to use these templates for the submission version as well. After using the templates, do not forget to remove authors' names and other revealing information for double-blind submission. 

Authors are expected to present their work in person at the conference. At least one registration per paper is required in order to be included in the proceedings. Authors shall register for the conference prior to submitting their final draft for publication. At the conference, authors of accepted papers will be given 25 minutes to present their work, followed by 5 minutes of questions. 

Research papers must be submitted through the EasyChair site at https://easychair.org/conferences/?conf=dfrwseu2017. Submissions must be in Adobe Acrobat PDF format. Send any questions about research paper submissions to eu-papers (at) dfrws (dot) org. 

PANEL PROPOSALS: These should be one to three pages and clearly describe the topic, its relevance, and a list of potential panelists and their biographies. Panels will be evaluated based on the topic relevance and diversity of the panelists. 

Panel proposals must be emailed to eu-panels (at) dfrws (dot) org in PDF or plain text format. 

NON-RESEARCH PRACTITIONER PRESENTATIONS: DFRWS EU / IMF 2017 is soliciting proposals for 15-minute presentations that showcase forensics experiences of interest to DFRWS attendees, including (but not limited to) case studies and advances in user interface, real-time analysis, and triage. Presentation proposals are not included in the printed proceedings and should not be anonymized. Presentation proposals only undergo a light reviewing process to make sure they are of interest to the community. Sales pitches will not be accepted. Presentation proposals are in the form of an abstract (150-300 words) in PDF format. At least one author is expected to register and present their work in person at the conference. Presenters will be given 15 minutes, followed by 5 minutes of questions. Presentation duration will be strictly enforced. 

Presentation proposals must be submitted through the EasyChair site at https://easychair.org/conferences/?conf=dfrwseu2017. Submissions must be in Adobe Acrobat PDF format. Send any questions about presentation proposal submissions to eu-papers (at) dfrws (dot) org. 

DEMO OR POSTER PROPOSALS: DFRWS EU / IMF 2017  welcomes demonstrations or posters of proof of concept and research-based tools. Proposals should describe the tool, its relevance to the forensics field, and space/equipment needs (e.g., table size, power, networking, etc.).
 
Demo or poster proposals must be emailed to eu-demos (at) dfrws (dot) org in PDF or plain text format. 

WORKSHOP PROPOSALS: DFRWS EU / IMF 2017 offers an expanded opportunity to present half-day or full-day workshops and vendor-agnostic tutorial sessions. Tutorial/workshop proposals must be emailed to eu-workshops (at) dfrws (dot) org in PDF or plain text format.

LIGHTNING TALKS: Conference attendees are invited to present parts of their ongoing work or open research questions for 5 minutes. Registration for lightning talks is possible at the conference. 

STUDENT AWARD and STUDENT SCHOLARSHIP PROGRAM

DFRWS continues its outreach to students studying digital forensics. This year DFRWS will be offering an award with a cash prize to the best student paper. A student paper is any paper in which the majority of the work was performed and the paper written by full-time students at an accredited university, college, or high school.

A limited number of scholarships may be awarded to students presenting a paper at the conference. The intent is to help alleviate the financial burden due to the cost of hotel expenses and conference registration.