Event Calendar
Prev MonthPrev Month Next MonthNext Month
Minnesota Chapter Training Day March 14th, 2019
Bloomington City Hall
1800 W Old Shakopee Road
Bloomington, MN 55431
Thursday, March 14, 2019, 11:00 AM - 4:00 PM CDT
Category: Chapter Meeting

Minnesota Chapter Training Day

March 14th, 2019 at Bloomington City Hall

Business Meeting from 11:00 AM to Noon. (Join via GoToWebinar)

Instructor Mark Spencer of Arsenal Consulting / Arsenal Recon from Noon - 4 pm.  (Registered non-defense guests welcome).

Social Hour afterwards

Topics to be covered:


Advancements in Windows Hibernation and Crash Dump Forensics
The tools and techniques used for years to analyze Microsoft Windows hibernation and crash dumps have, in many ways, left digital forensics experts in the dark. For example, maximum exploitation of hibernation files requires that your tools not only support the "modern" (Windows 8/8.1/10) hibernation format, but extraction of the multiple types (and levels) of slack space within them. Mark Spencer will provide attendees of this presentation with details about Windows hibernation and crash dumps that are particularly relevant to digital forensics practitioners and then discuss significant advancements in the tools and techniques used to analyze them.


Exposing Smoke & Mirrors in Digital Forensics
Arsenal President Mark Spencer will lead attendees on a journey through the dark side of digital forensics in this revealing presentation. Mr. Spencer will share his experiences identifying and confronting the use of smoke and mirrors by “experts” and detail how he ultimately enlightened both his clients and the courts.


Contact: Douglas Barland, President HTCIA Minnesota, [email protected]