The story of Greendale

Ever wanted to do forensics and feel good about it? This talk will introduce you to a suite of open-source tools for all things digital forensics and incident response. You will see how Greendale (a fictitious but very famous university) used this set of tools to articulate an effective response to a pretty severe incident last summer—all on a state-financed university budget! We will cover collection of forensic evidence with GRR, processing with Plaso, and analysis with Timesketch; how these tools can be articulated using dftimewolf, how to remotely image disks and have the processing done in the Cloud. 

Thomas Chopitea 
Thomas is a forensics investigator and engineer at Google. Previously, he worked at CERT Société Générale, where he bootstrapped the threat intelligence process using a combination of existing and homebrew open-source tools. He likes to write code and hunt down bad guys. His long-term professional goal is to automate himself out of a job.