|Date||October 1, 2019|
|Time||10:30 AM – 11:20 AM|
Discussions about electronic evidence tampering are often academic, leaving participants skeptical about the practicality of various tools and techniques they have just seen. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case – from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Arsenal President Mark Spencer will demonstrate the ‘Anchors in Relative Time' analysis technique which ultimately revealed that the journalists' computers were attacked both locally and remotely, including the use of a RAT never seen before (or since) in the wild.