Registration is Now Open for Magnet Summit 2022!

Magnet Forensics is excited to announce that Magnet Summit 2022 registration is now open! Save your spot for the leading DFIR event of the year which will feature an in-person experience in Nashville as well as an additional FREE virtual event.

Learn more and register here.

In-Person Event in Nashville April 11-13

Our highly anticipated return to Nashville is happening! Attend this premier DFIR Event that promised an immersive experience to connect with your peers, Magnet experts, and industry leaders.

We’ll be at the Sheraton Grand Nashville Downtown Hotel in Nashville, TN from April 11-13. In addition to attending presentations, taking part in activities, and earning CPE credits with hands-on labs and workshops, you will also have access to all of the additional guest presentations during our virtual event.

Get The Latest DFIR News!

Top DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Don’t miss the DFIR event of the year! Learn more about the in-person experience here.

Worldwide Virtual Event April 20-28

By registering for our free virtual event, you’ll get a free front row seat to hear from some of the leading DFIR experts from around the world. Learn about the biggest trends and challenges in the industry in a series of captivating presentations, all from the comfort of your home

Learn more about the virtual experience here.

Earn CPE Credits from Labs & Workshops

Most labs and workshops at Magnet Summit 2022 will be eligible for CPE credits.

  • Labs – 1 CPE credit
  • Workshops – 1.5 CPE credits

Following the event, Magnet Summit Registration Services will provide a Certificate of Attendance to each individual who attended at least one CPE-eligible session.

Pre-Conference Training & New Certification

Before we get started at the in-person Magnet Summit, we’ll have our Training team in Nashville offering our AX301AX320, and AX350 courses, giving you the opportunity to get some extra training done while at the event. With the completion of a course, you’ll be eligible for up to 32 CPE credits. Plus, if you have a Training Annual Pass, the price of these courses will be included!

Attendees to the training course, will receive a free pass to the event. 

We’re also excited to be offering three new certifications at Magnet Summit 2022, including Magnet Certified Macintosh Examiner (MCME), Magnet Certified Cloud Examiner (MCCE), and Magnet Certified Video Examiner (MCVE).

Take Part in CTFs at the In-Person and Virtual Events

We’re keeping the CTF dream alive! The Magnet Summit 2022 CTFs promise exciting challenges that will see some of the top DFIR examiners in the world participate. And thanks to our win in the Forensic 4:cast Awards for best CTF, you know we’ll provide a unique and interesting challenge.

Mentorship Day

Looking for advice to move forward in your DFIR career? Mentorship Day at Magnet Summit 2022 will feature seasoned professionals offering career advice, along with resume reviews, to make sure you’re equipped with the knowledge you need to keep your career momentum going.

Save Your Spot for Magnet Summit 2022

Of course, there will be even more activities, networking opportunities and chances to learn at the in-person and virtual Magnet Summit 2022. This is a not to-be-missed event of the year for all of our valued Magnet Forensics customers and industry friends!

Head over to www.magnetsummit.com to learn more — including who will be speaking and what topics they’ll be presenting — and register today!

Leave a Comment

Latest Videos

Quantifying Data Volatility for IoT Forensics With Examples From Contiki OS

Forensic Focus 22nd June 2022 5:00 am

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run. 

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems. 

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run.

Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems.

In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS.

We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX.

Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source.

Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases.

Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

Learn more: https://dfrws.org/presentation/a-systematic-approach-to-understanding-macb-timestamps-on-unixlike-systems/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_i0zd7HtluzY

A Systematic Approach to Understanding MACB Timestamps on Unixlike Systems

Forensic Focus 21st June 2022 5:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...