Example master projects include:
- Find and analyze new operating system artefacts, such as when a given user was present, what types of USB devices have been connected, what WiFi networks have been used, etc.
- Find and analyze new application artefacts, such as GPS locations, timestamps, password hashes, search history, heart rate data, contact information, etc.
- Research and develop tooling for preliminary assessment (triage) for an operating system; What is readily available information, and what can be gathered with suspect cooperation or initial access by other means?
- Research and develop tooling for preliminary assessment (triage) for a given local network. What devices are present, and what can we learn about them? What can we determine about the router? What is possible by passive observation, and what requires active measures?
- Research and document novel hardware, such as set-top boxes, WiFi cameras, smartwatches, etc. Can we access the firmware (either on the device or via OTA updates)? What are the operating system, file system, and applications?
-
Use of AI / Machine Learning in forensics
While there are many opportunities, challenges remain in terms of explainability, bias, reproducibility, and legal admissibility. There is also the open question of how such methods can be validated for forensic use and how they can be applied in court. -
macOS forensics
Compared to Windows and Linux, macOS forensics is still underexplored. There is a need for more systematic research on artifacts, file system structures, and methods for collecting and analyzing evidence.
Some prior technical knowledge of the given platform, e.g., Android or GNU/Linux, is beneficial but not required.
The list above is intended as inspiration, not set in stone. If you have any ideas or experience with offensive security, digital forensics, and/or analysis techniques, feel free to suggest a topic!