DFRWS EU 2023. Bonn, Germany

This year, my first paper, co-authored with my research partner and best friend Anis Lounis, was accepted at DFRWS EU 2023 (Digital Forensic Research Workshop). Perhaps not a great deal for veteran academics, this was a milestone for us. We worked for a year, side-by-side, in our empty lab during COVID-19. When the paper was accepted, Anis had an earth-shattering reaction due to his shock and disbelief that our efforts paid off; a victory and miraculous outcome for us. This meant we would have to travel to Bonn, Germany, where DFRWS EU 2023 was scheduled to take place. In this article, I document each day; a direct transcription from a journal I kept on-hand. Some parts were omitted due to person(s) of interest not wanting exposure.

20/03/2023

Yesterday morning, the 19th, I awoke to prepare for the presentation in Bonn. We didn’t have as much time as I expected to polish our delivery, let alone the content of the slides. To me, time was ticking, and in three days we would be on-stage presenting; not much time considering we wouldn’t have much time in those three days to actually rehearse and adjust, but we will get it done, regardless. Anis and I were driven by Dad to Trudeau airport. We quickly passed through security with our giant, heavy-packed 32-Litre bags. Fifteen minutes later we were at our gate, sitting with passengers of the flight boarding before us. That’s right; that early.

The flight was the final revelation of the cowardice of my imagination. Minor turbulence, looking out the window to the deathly drop below, nerves, and the take-off and landing sequence. All of it, fears of complete irrationality. I’m tired of fearing flight. This time, most of the fear escaped me by pulling away… by letting the turbulence and sudden movements take my body. I said to the plane, “do with my body what you will”. Most of the fear has now been overcome. Adios.

We took the ICE train from Frankfurt to Cologne (or Köln, pronounced differently depending your native language). When we asked the man at the info-center how to reach the train, we were directed, and when we asked if we could also buy tickets there, he responded as if speaking to a man with a pea brain, “it’s a train station”. We struggled to find a method for purchasing these tickets as the damn machines were so confusing for these two English-interface-expecting suckers. A rock of a man tried to help us realize Cologne should be spelt Köln, but even then the machines confused us. Eventually we purchased tickets from an attendant and found our track. We boarded and sat immediately behind the conductor, and witnessed a marvelous view and speedy travel (300 km/hr). From Cologne, we took the RB train to Bonn Hbf (hbf means “central station”) and proceeded to walk around the city. It is gorgeous, even in springtime. The houses are painted with palettes of pastel hues; pink, purple, orange, yellow, and cream. What a wonderful color for a home’s exterior. One was even military green!

Strangely, when passing through the streets in the photos above, with my camera around my neck, a man punched his window twice from two storeys above us. I looked around, and we were the only ones in the street, so he must have been knocking at us. Couldn’t understand why. Dude was mad though.

We walked around the Münsterplatz and there Anis purchased his SIM card. The cashier told me I reminded him of a League of Legends streamer on YouTube. We looked him up, and after seeing his ugly mug, and I said to the man, “You’re telling me I came half-way across the world to be told I look like a horse?” Interestingly, I was in Bonn to present a paper where we analyzed a supply chain attack on League of Legends.

Next, we hit Flynn’s Pub for a burger and fries. I had three beers and Jocko Greens.

The presentation is still in an abysmal state. We will get there; only two nights left. I love this freedom, and will chase it for the rest of life. I’ve been up for 1 day and 16 hours. Time for bed. OUT.

21/03/2023

Yesterday was a great day. We met a man named Charles from Sweden, and a German man, Seb, interested in forensics. We met a Ukrainian man who told us he believed Zelenskyy is corrupt, a puppet of the West (hence why the West like him), and that he does not want the war to end due to West-provided funding and resources. None of this can be confirmed, but it is interesting to hear differing opinions on the matter. Kind, quiet people. We took part in a great workshop on Malware Analysis that confirmed much of our research, and later went to Havanna, a beautiful bar for drinks. There, we spoke with two kind German men about their history and politics: how the “left” there are Pro-Russia in the Ukrainian war (because Russia provides a major source of “cheap” energy, without which the poor would be encumbered with a higher cost of transportation energy), how the left in the West are Pro-Ukraine, and how their leader(s) are generally centrists with slight left-or-right leanings (as they must absorb leaning-ideology to meet numeric representation requirements). These men also explained to me there is a spot in Bonn, roughly 20 minutes away, where locals have become sickened by the amount of tourists photographing their beautiful pink, blossoming trees. One local threatened to kill these trees off if something was not done to reduce tourist photography in the area. I cannot confirm this, but it may be the reason for the man punching the window as I walked through their street (having those exact, pink-blossoming trees) with a camera around my neck.

22/03/2023

Today was the first day of presentations. Most are overlong, lean towards pontification, and fatigue the audience. Mostly, this comes from unpreparedness, over or under-confidence, meta-explanations (overly telling the audience why and what will be explained), the use of “uhm”, lack of expressiveness to indicate to the ears how they should hear, unconscious pausing, believing all what you say is indeed important enough to be said, saying things that are not clearly linked to visuals (I call this “freetalking”, where the presenter is speaking but the audience cannot match the words to a point in the slide, and thus the presenter and listener are both “free” from their responsibility of oration and comprehension, respectively), creating diagrams that make sense only to the presenter, unlabelled diagrams that make interpretation ambiguous, overlabelled diagrams that cannot be easily interpreted, and eating carb-heavy lunch and snacks just prior to sitting and listening.

It seems most audience members are interested in works despite being delivered through the most fatiguing presentations. For those interested in the material, even a deadly stinker of a presentation somehow delivers its message. This doesn’t make it permissible to practice poor presentation, however. It just means you’ve been lucky enough to be preaching to the choir.

All these presentations forced me to think of my own, and then my mind wandered to my research partner and best friend, Anis. Amazingly, he is highly distracted by the sight of sweets; it utterly takes his mind away. It is impressive. His focus in rehearsing at night is quite low, too tired to function, seated lazily with lacklustre energy. I can’t blame him though, as the days were long, jetlag setting in, and Ramadan on his heels. However, it is crucial to fully take part during rehearsal, regardless of fatigue. There is no fatigue. Make it count, else you will simply practice the solidification of a poor performance.

At night, we went to the wonderful boat ride on the Rhine right beside our hotel (Prizeotel Bonn-City). The interior was gold-plated and red-velvet. Anis and I sat together at our own booth. It was an utterly romantic and uplifting night with drinks and smiles. On the deck we met an academic from Winnipeg who met his wife travelling, and who once worked in industry forensics. His face dimly lit by the boat lights, with wind slowly blowing through his white and luscious hair; I felt I had met a sage. He would be given missions to inspect the computers of suspicious employees, taking photos of their workplace prior to investigation to assure nothing would seem out of place the next morning when the employee returned for work. When asked, his best advice for me is to keep calm — don’t stress out. It was a “high” moment for me. We retired to our hotel and rehearsed until 12:30 AM instead of attending the Rodeo (forensic challenge). We grinded the presentation, removing slides, combining others, cutting redundant speech, and building our total comfort to a fixed-point. We eventually gained and felt the comfort and familiarity with the material in our heart, and that’s when we knew to stop. Sleep came. Well-deserved.

23/03/2023

Today was presentation day. We arose at 6:30 AM. I’ve been sleeping really well here. We rehearsed once more before leaving for the University. Once there, we met our chair, Maike, who was delighted by our presence and timeliness. It reduced the need for her to run around and find us. This is a key lesson; reducing others’ uncertainty is a certain way to get in their favor — no matter how minor, it is always worth your sacrifice.

We were called to present, but my headset microphone failed, and I was given a handheld microphone instead, to which I commented “I’ve always wanted to hold a microphone, so we’re good.” The presentation was excellent and on time (as we had practiced). We got advice to use BinDiff as an optimization on updates by Paul from Volexity. Later, when we got off stage and went to our first break, we spoke with a woman who approached us to comment on our impressive presentation (Janine). She was a sweet woman and I enjoyed speaking with her. I stood with her in line for food and we got to know each other better.

Another man told us we had a great presentation, and explained the SBOM is a point of interest for Supply Chain Dependency Verification (interestingly, we heard this same advice after presenting in Canada). We spoke with Veronica Schmitt who we think could work with us to find vulnerabilities which can be used to infiltrate and inspect the contents of a medical device. Difficult to tell the potential of this idea. It was a great lunch break speaking with these supportive folk. They’ve been so sweet to us, and have helped me love academia more than I thought I could. It allows for such a thrilling way-of-life, focused and productive enjoyment, and free exploration. I have really been forced to change my mind about my future.

Just now in the dessert line, one man told me of a tool named “capa” which outputs MITRE attack behaviours present in a binary. This is something we really should look into. As well, a Professor approached claiming his students want to create a semantic graph with labelled functions, like “downloads file”, etc… You need to get his information.

24/03/2023
Last night, I headed to Tresor. It was a last ditch effort to meet the people of DFRWS. I was tired and not in the mood to socialize. Fortunately my earlier acquaintance Seb was there as well. We eventually spoke about our lives; he about his experience with Martial Arts, and myself with Hinduism. We drew many parallels between the lessons behind the physical aspects of Material Arts, and the intellectual and experiential teachings of the Bhagavad Gita. We found that both are concerned with the dissolution of the ego, only through different means, and that the traumatic experiences in our lives have opened our eyes to the simple beauties of existence like the chirping of the birds, and the green-ness of the grass and trees. Our discussion was truly one significant highlight of the trip. I met many other wonderful people that night, and will miss them all dearly. Perhaps I become too emotionally attached to strangers whom I share a laugh or a deep story with, but my heart is the way it is.

This day started on the bus on the way to the Regierungsbunker, an old cold-war era bunker. We descended the bus after 45 minutes of riding, and walked up a zig-zag hill to its entrance. The bunker was a holding place for the most important officials needed to reconstruct society in the event of atomic bombing. We now know it would not hold up against such power. Turns out the bunker was mostly used for training and simulations of real end-of-world scenarios, yet some of it was spent drinking and messing about. The photos will do more justice than words, but clearly the threat was taken seriously. Services like barber shops were available underground with the intent to retain an illusion of normalcy in the event of lockdown and isolation.

Once the tour was complete, Anis and I spoke with a young woman named Olivia, and her friend Kiranjit. The latter attended the conference to taste the subject of forensics; everyone with a different purpose! The former is sweet woman who lives an hour from Berlin. I was utterly enchanted by her finesse and clear-faced charm. On the way back, she asked for my email. I did this trip justice; making small but beautiful relationships throughout my time here.

We then trekked together up to the vineyard, having such pleasant conversation with Kiranjit and Olivia. Once at the top, we were presented with many tables for wine tasting and eating thin pizzas (Flammkuchen, I’m told) with various toppings; and they just kept on coming. We got drunk and bloated. We walked around outside, getting some fresh air and taking in the strange “new” world around us; one we wouldn’t see back at home. I thought of my mother while watching the clouds hover over the mountaintops. She wouldn’t believe where I am now, and I still can’t believe she is gone. I know she must be one proud mother right now, however. When the party was over, our bus dropped us off back in Bonn. Jan, conference chair, let us know it was the end, and we all parted ways. That was our last day in Bonn. The goodbyes are damn hard.

25/03/2023

We awoke around 4 AM, and I had a broken heart. Missing everyone and everything in Bonn. I hurriedly got ready for the train. Off we went into the pre-dawn morning, roughly 4:40 AM. We took the train into Cologne, and subsequently boarded the ICE for Berlin. There is something about waking up in the early AM when your heart is broken; it gives one the feeling of standing in a rainstorm with the sun sitting behind the dark clouds, with its warmth barely reaching you.

Lessons Learnt

Here, I list a set of lessons learnt from this trip, according to my experience and demeanor:

1. Travel with a responsible friend makes the trip smoother. Communicate with them the plan at every necessary interval, and make sure you’re both aligned.
2. When preferences diverge on what to do, splitting up for some time should not be considered as an offense, but an opportunity for each party to enjoy themselves to their preference.
3. Ask, if you can, what is the custom for smiling at strangers; in Germany it is frowned upon. Helps you not look like a grinning fool.
4. What starts as an awkward event usually leads to bliss and joy if you simply wait it out and start interacting with others.
5. Your time preparing and rehearsing will have a larger effect than staying out and drinking when it comes to your career, but never dismiss the benefit of delightful, drunken human interaction. Just don’t overdo it. Remember the work, always.
6. Before going to a new city, understand how the bus, tram, and subway work; how to get tickets (app, machine), and know transportation-system nomenclature. This will save you time, and anxiety.
7. When taking inter-city trains, head to the train station early, and scope out the station to figure out how to find your track/platform (i.e., how to read the departures board). If your track number/letter information is available ahead of time, walk over to it to assure you know its location; only then can you walk around freely, without worry, looking for food, always knowing where to go at departure time.
8. Bring change in the currency of your destination as most machines (bus tickets) and services (toilets) accept 1-2 euro coins only.
9. You don’t need to have giant research to publish; just well placed and needed work. Rethink how you spend your efforts.
10. Flight is not to be feared
11. Pack lighter
12. Prepare eSim before-hand and waste less time at your destination setting up your cellular network (Airalo is great for this).

The organizers of DFRWS EU 2023 are a phenomenal bunch who really did justice to us attendees. I have to thank them from the bottom of my heart for giving us such a memorable experience. Never have I felt so fulfilled, joyous, and bliss-filled. I hope to be back in some form, to either assist the team in logistics, organization, photography, or through another submitted work.

It was a pleasure travelling with my good friend Anis Lounis. We kept each other on track, looking out for proper signage, keeping each other company, enjoying moments together that would have been lost alone, and “braving” through confrontations with the unknown.

My next post will document my experience in Berlin, Germany (which was not part of the DFRWS conference itself, but an extended vacation after the conference end-date)