9:00 – Registration start

9:50 – Opening & welcome speech

10:00 – Igor Loskutov, Rusolut, Poland

“10 Years of Innovation and Progress at Rusolut”

Abstract: This presentation will take you on a journey through the past 10 years, highlighting the evolution of our flagship product, VNR, along with other key innovations that have defined our company. From pioneering new features to enhancing existing functionalities, the journey of Rusolut reflects our commitment to excellence and our response to the evolving needs of our customers. We will also showcase our latest research and developments. Attendees will gain valuable insights into the technological breakthroughs and strategic initiatives that have driven our development. Join us to celebrate our achievements and discover the future direction of Rusolut as we continue to push the boundaries of what is possible.

11:00 – Gareth Davies, Thales, UK

“Vehicle forensics best practice and future direction.”

Abstract: Modern vehicle infotainment systems offer a rich source of evidence for digital forensic practitioners. However, due to lack of guidance and supporting validation tools, practitioners struggle with both data acquisition and analysis. There are general legislative acts and frameworks regarding digital forensics that can be applied to vehicle forensics, but processing vehicles requires, at times, a different approach, such as with the transportation and storage of automobiles, and analysis of proprietary systems.
The presentation summarizes current capabilities in vehicle forensics and presents an overarching best practice guide on processing vehicles from crime scene to courtroom and discuss the future of autonomous vehicles in respect to digital forensics and accident investigation.

12:00 – Sasha Sheremetov, Rusolut, Poland

“New Technology – Vehicle Data Reconstructor. Game changing solution in Digital Forensics for Vehicles. Extra: Drones”

Abstract: Discover the New Technology – Vehicle Data Reconstructor, a groundbreaking innovation in digital forensics for vehicle data acquisition and analysis. This technology excels in processing data from infotainment systems, telematics units, wireless modules and ECUs. Additionally, we will touch on advanced forensic techniques for drones.

13:00 – Lunch

14:00 – Aya Fukami, Digital Forensic Researcher, Netherland Forensic Institute, Netherlands

“Exploiting the eMMC secure features using the VNR”

Abstract: In this presentation, I will share recent research on eMMC security features. The first half will focus on the Replay Protected Memory Block (RPMB). We encountered a case requiring manipulation of the RPMB partition in an eMMC. The target smartphone utilizes RPMB as an anti-rollback feature, and editing the stored data requires an authentication key programmed at the factory. Using VNR, we successfully extracted this key from the target eMMC, enabling us to manipulate the data stored in RPMB and restore the target smartphone to the rolled-back state. The second half of the presentation will address the Secure Erase functionality of eMMCs. Our tests revealed that most data remains on the flash memory even after executing the Secure Erase command. I will demonstrate how VNR helped in resolving these issues.

15:00 – Jeremy Brock, RecoverMyFlashDrive.com, USA

“Reverse Engineering & Monolithics”

Abstract: Translation Tables, pSLC, Special Commands / Read Retry. Monolithics: Methods and Techniques (to be updated soon)

16:00 – Michal Pawlikowski, CEO, Arvika/FlashKiller, Poland

“Flash – how to make life easier.  Tips and tricks”

Abstract: During the speech, the fundamentals of working with flash based devices will be presented and explained. The speech will provide practical advices, i.e. how to facilitate and speed up work with flash memories based on many years of experience. How to identify a problem, solve it as quickly as possible, what tools to use, including recommendations and warnings on what to avoid.

16:40 – Group Photo, Lottery & Anniversary celebration

17:30 – Networking & Cocktail reception

19:00 – Closure

ROOM 1 – MONOLITH PINOUT DISCOVERY GROUP

On this part of the bootcamp we will explain the technology of pinout discovery from monolithic devices. You will learn:

• the structure of monolithic devices

• technological pins of monolithic devices and how to get access to them

• how to select technological pins for analysis

• what is logic analyzer

• settings of logic analyzer and how to use it

• signal states and review of NAND interface and protocol

• how to take and analyze waveforms and more…

ROOM 2 – LAW ENFORCEMENT GROUP

Closed workshops available only to representatives of law enforcement agencies with specially tailored content based on real investigations and criminal cases. We will show:

• Current Research and Progress with Embedded Devices

• New Tools for Embedded File Systems

• Vehicle Forensics:

– New solution and new adapters for solderless and chip-off techniques of data extraction
– Exploration of different manufacturers and their systems
– Types of recoverable data
– Hands-on work with real-world case

• Network Device Forensics:

– Notable discoveries within routers
– Overview of user data and methods of extraction
– Practical work with real-world cases

• Drone Forensics:

– Overview of memory chips in drones of a leading brand
– Unexpected and expected findings in drones
– File system reconstruction from NAND memory in actual cases