On August 22-23, attendees in Salt Lake City, Utah and thousands from around the globe tuned in for the SANS DFIR Summit. Top practitioners and global experts shared actionable ideas, methods, and techniques to overcome obstacles, discover the latest open-source forensic tools, and connect with leading DFIR professionals.
We invited Ashton Rodenhiser of Mind's Eye Creative to create graphic recordings of our Summit presentations. If you missed a talk or are looking to view the SANS DFIR Summit through a visual lens, take a look at the recordings below.
*If you registered for the Summit, video recordings will be available on your Summit Access page in your SANS Portal next week!
How persistent is an APT? Battling Three Threat Actors in a Single Environment
Oren Biderman, Incident Response Team Leader, SygniaAmnon Kushnir, Director of Incident Response, Sygnia
![01_SANS_DFIR_Biderman_Kushnir_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt5e44bdf05d976e32/66c781fee712ef2aac313496/01_SANS_DFIR_Biderman_Kushnir_WebVersion.jpg)
Cutting Through the Chaos: File Detection and Analysis Using Strelka
Paul Hutelmyer, Principal Engineer, Target Corporation![02_SANS_DFIR_Hutelmyer_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt00180c232085e06c/66c7820fab1b6937ad3ccaa6/02_SANS_DFIR_Hutelmyer_WebVersion.jpg)
The Allure of The Hunt: Drawing New Talent Into DFIR
Chandler McClellan, Student, Intrusion Analyst Intern, Utah State University, CrowdStrike![03_SANS_DFIR_McClellan_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt37390f5f24ce6be7/66c7821daff77d867cc44548/03_SANS_DFIR_McClellan_WebVersion.jpg)
Gaining Better Visibility on a Cloudy Day: Additional Microsoft Cloud Data Sets You May Not Be Looking At But Probably Should
John Stoner, Security Strategist, Google Cloud![04_SANS_DFIR_Stoner_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt4baab08788f7f948/66c8a642e28d8711f4b0d7e9/04_SANS_DFIR_Stoner_WebVersion.jpg)
Dormant Devices, Chatty Logs: Extracting Forensic Artifacts from Seemingly Idle iOS Devices
Cesar Quezada, Director of Forensics, HexordiaNick Dubois, Mobile Vulnerabilty Researcher , Hexordia
![05_SANS_DFIR_Quezada_Dubois_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt4a7cd5a73c337834/66c7a284dd1a365fa040e5e8/05_SANS_DFIR_Quezada_Dubois_WebVersion.jpg)
Not All Androids Who Wonder Are Lost. Exploring Android's Find My Device System.
Joshua Hickman, Digital Forensics Expert, Cellebrite![06_SANS_DFIR_Hickman_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6d388e1cffb8787c/66c7addc1ee8055e93169137/06_SANS_DFIR_Hickman_WebVersion.jpg)
Getting down and dirty with Mac imaging
David Dym, Director, KPMG![07_SANS_DFIR_Dym_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt1d9d31fe0668a0f4/66c7d49b3f4c1920731cf1b0/07_SANS_DFIR_Dym_WebVersion.jpg)
Forensic Analysis of Compromised VPN Appliances by Advanced Actors
Fernando Tomlinson, Technical Manager, Digital Forensics and Incident Response, MandiantMatt Lin, Senior Consultant, Incident Response, Mandiant
![08_SANS_DFIR_Tomlinson_Lin_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt0b9c53e413e2c3af/66c7d4ac20995e67dcd2e7ff/08_SANS_DFIR_Tomlinson_Lin_WebVersion.jpg)
Keynote | Days of Future Past: The Impacts of GenAI on Cybersecurity
Rob Lee, SANS Fellow![09_SANS_DFIR_Lee_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt00f5edeb0d0d397f/66c8b68ee28d87e50fb0d912/09_SANS_DFIR_Lee_WebVersion.jpg)
Cloud Kleptos: Lessons Learned Responding to Scattered Spider
Abian Morina, Associate Threat Researcher, Permiso Security![10_SANS_DFIR_Morina.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt228f84741bc927cc/66c8c70defc13a2093831370/10_SANS_DFIR_Morina.jpg)
Rise of the Drones: Modern Drone Forensic Opportunities
Daniel Flack, Exploitation Team Lead & UAS/cUAS Subject Matter Expert, Edgesource Corporation![11_SANS_DFIR_Flack_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blta4f8f8333d6d367b/66c8c6e448a3a1ed7310b8be/11_SANS_DFIR_Flack_WebVersion.jpg)
Ghost in Your Supply Chain
Alian Wang, Detection & Response Analyst, CyCraft Technology CorpChung-Kuan Chen, Security Research Director , CyCraft Technology Corp
![12_SANS_DFIR_Wang_and_Chen_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt21673e599027a3ce/66c8ed61e28d8774a1b0db57/12_SANS_DFIR_Wang_and_Chen_WebVersion.jpg)
Leveling Up Ghidra: Learn Ghidra Plugins with a Game Boy Game
Jacob Latonis, Senior Software Engineer, Threat Research, Proofpoint![13_SANS_DFIR_Latonis_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/bltaf97763f7ce9a264/66c8ed6fd317495b5aad4094/13_SANS_DFIR_Latonis_WebVersion.jpg)
The SaaS-y Side of Incident Response
Cody Craig, Principal Incident Responder, Mitiga![14_SANS_DFIR_Craig_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt7dc1c6434781685d/66c90fb8e82cec226c13a104/14_SANS_DFIR_Craig_WebVersion.jpg)
The Tortured Responders Department: Scott & Rebekah's Version
Scott Roberts, Head of Threat Research , Interpres Security![15_SANS_DFIR_Roberts_and_Brown_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt687edbad446c4845/66c90fc776967307ff677ae7/15_SANS_DFIR_Roberts_and_Brown_WebVersion.jpg)
Llama: The Fast File Processor With No Drama
Jon Stewart, Managing Director , Aon Cyber SolutionsJulia Paluch, Software Developer, Aon Cyber Solutions
![16_SANS_DFIR_Stuart_and_Paluch_WebVersion.jpg](https://images.contentstack.io/v3/assets/blt36c2e63521272fdc/blt1937d6848f86261d/66c90fda25a27908c3a0228c/16_SANS_DFIR_Stuart_and_Paluch_WebVersion.jpg)
If you'd like to check out our other upcoming Summits, you can view the latest listing here.