Magnet User Summit 2027: Your presentation catalog is here
What’s shaping digital investigations today, and what should you be preparing for next?
At Magnet User Summit 2027, we’re bringing together the best in digital investigations to tackle those questions with practical insights, hands-on learning, and perspectives from experts across the field. Join us March 8–10 in Austin to explore how AI, automation, mobile forensics, cybersecurity, drone forensics, media authentication, and evolving lab demands are changing the way investigations get done.
And now, you can start planning your experience with the Magnet User Summit 2027 presentation catalog.
Along with sessions from experts across law enforcement and the private sector, you’ll hear from Magnet Forensics leadership during our executive keynote and have access to a dedicated prosecutor track featuring resident legal expert Justin Fitzsimmons.
You can also go hands-on with Magnet Axiom, Magnet Nexus, Magnet Graykey, Magnet Review, specialized workflows, and more, while discovering practical approaches you can bring back to your day-to-day work. Select workshops will offer opportunities to earn CPE/CLE credits as well.
Find the complete catalog here and be sure to register early to take advantage of early bird pricing!
Keynote presentation
Investigative intelligence: Where innovation meets the mission
Magnet Forensics executive leadership
Every connection needs to be uncovered. Every insight needs to be verified. Every minute counts.
In this executive keynote presentation, John Curry, Braden Thomas, and Jad Saliba will explore the continual innovation behind investigative intelligence and how Magnet Forensics is delivering solutions to meet the demand of modern investigations.
Learn how Magnet Forensics is focusing on connected investigations to unite your evidence, your teams, and your workflows, so critical leads surface faster and nothing gets missed. Plus, they will shine a light on members of the community that are making a difference by presenting the Magnet Forensics Agency Impact Awards and naming the winners of the 2027 Scholarship Awards.
Grounded in mission-driven innovation, this keynote will offer an exclusive look at what’s next for Magnet Forensics in 2027 and how it will help you stay ahead in your digital investigations.
Join us for special presentations of our various Unpacked series
AI Unpacked: But why? Questioning everything about AI in digital investigations
Brandon Epstein, Principal Digital Forensic Specialist, Magnet Forensics
As investigators we inherently question everything, but are we asking the right questions about AI? In this session, Brandon moves beyond the usual AI discussions and buzzwords to focus on evaluating AI through a critical, yet practical lens. We will explore the questions examiners, investigators, and attorneys should be asking when deploying AI in investigations and the courtroom to produce reliable, confident, and admissible results.
Mobile Unpacked: Can I have your “Intent”-ion please? Understanding iOS Intents
Christopher Vance, Staff Technical Forensics Specialist, Magnet Forensics
The use of the underlying “Intent” function is often a hot topic in digital forensics because of what it includes at times. This talk will dive deep into the “Intent” function and discuss how these artifacts are created in the device. These additional artifacts will be evaluated from a most to least useful system to help further examinations.
Cyber Unpacked: Persistent problems, new playbooks: Closing the gaps in enterprise DFIR
Doug Metz, Senior Security Forensics Specialist, Magnet Forensics
Jeff Rutherford, Forensic Consultant, Magnet Forensics
Enterprise DFIR is evolving, but a fundamental challenge remains: getting to the evidence. Three in four enterprise DFIR professionals surveyed by Magnet Forensics said they had been unable to access data they believed existed. Meanwhile, mobile evidence, distributed endpoints and disconnected workflows are adding complexity and slowing investigations.
This session will share practical approaches for improving remote investigations across endpoint, cloud and mobile evidence, reducing friction between tools and teams, and applying AI responsibly with validation and human judgment at the center.
You’ll leave with actionable ways to close investigative gaps and prepare for what’s next in enterprise DFIR.
Private Sector Highlights
The end of follow-the-sun investigation chaos
Jonathan Leon, Cyber Defense Analyst, McDonald’s Corporation
JT Moore, DFIR, McDonald’s Corporation
Lynita Hinsch, Platform Consultant, Global Private Sector, Magnet Forensics
What happens when analysts across multiple continents need to work the same case at the same time? In this panel session, join a Fortune 500 company’s incident response leaders as they share how they transformed a fragmented, handoff-driven investigation process into a truly collaborative global workflow.
Learn how centralized case collaboration eliminated day-long transfer delays, reduced investigation effort by nearly threefold, and enabled teams across the U.S., U.K., and India to work together in real time on a single investigation. Discover the operational impact of distributed forensics and the lessons learned from scaling investigations across a global enterprise.
Memory forensics: Accelerating time to analysis with Magnet Automate
David Brown, Staff Cybersecurity Analyst, The Home Depot
William Pauly, Staff Cybersecurity Engineer, The Home Depot
As digital investigations scale in both complexity and volume, the rapid analysis of Random Access Memory (RAM) has become a critical, yet notoriously time-consuming, phase of incident response and forensic analysis.
For private sector enterprises and government agencies facing mounting case backlogs, automation is no longer optional — it is a necessity. This session demonstrates how digital forensic examiners can transform their memory forensics pipeline from a manual bottleneck into a streamlined, highly efficient workflow. By leveraging the orchestration capabilities of Magnet Automate, attendees will learn how to significantly reduce time-to-evidence and allow examiners to focus on high-value analytical tasks rather than manual processing.
This presentation will provide a comprehensive, step-by-step guide to architecting these automated workflows from the ground up. We will explore the configuration of Magnet Automate workflows, tailored specifically for memory captures, beginning with the seamless integration of Magnet Axiom’s built-in RAM analysis capabilities.
Moving beyond out-of-the-box features, the session will highlight advanced customization techniques, including the development and deployment of custom PowerShell scripts to execute custom workflows within Magnet Automate. Furthermore, attendees will discover how to integrate powerful external RAM analysis tools, such as Volatility3 and MemProcFS, directly into their Automate workflows.
By the end of the session, participants will be equipped with the actionable knowledge needed to build, customize, and deploy automated memory analysis workflows that dramatically accelerate investigative timelines across any organization.
Beyond USB and email: Modernizing departure investigations for cloud and AI
Daniel Gleisner, Director | Forensic Technology Services, Alvarez & Marsal
Departure investigations used to follow a familiar checklist: USB history, forwarded emails, recently accessed files. That checklist was built for an on-prem, laptop-centric world, and that world is largely gone.
Today’s departing employees work across cloud platforms, AI assistants, and a mix of personal and company devices. A sensitive file doesn’t need to be downloaded when it can be shared, synced, or pasted into a prompt, often leaving little behind in the artifacts examiners have relied on for years.
This session covers what’s changed in departure investigations: how cloud workflows complicate evidence of exfiltration, why AI assistants are a largely invisible new risk, and how BYOD raises new questions about collection authority. We’ll look at where the old playbook falls short, offer an updated framework examiners can use immediately, and flag where forensic tooling still needs to catch up.
Attendees leave with a revised checklist and a clearer view of today’s blind spots.
Ransomware in the real world: From first call to root cause
Brian Horton, Managing Director, Breadcrumb Cybersecurity
Ransomware investigations rarely unfold in a clean, linear sequence. Investigators and responders must quickly determine initial access, attacker activity, lateral movement, persistence, encryption scope, and potential data exfiltration while operational and leadership decisions are being made in parallel.
This session will use anonymized real-world ransomware case studies to examine what went wrong, how the investigation evolved, and the lessons learned. Each case will reconstruct the timeline from both the victim and threat actor perspectives — what the organization saw and knew at each stage versus what the attacker was actually doing inside the environment.
Attendees will see how endpoint artifacts, security telemetry, identity data, network evidence, cloud activity, and other evidence sources are correlated to build and test that timeline, identify investigative gaps, and improve response decision-making during complex ransomware events.
Burning at both ends: How a data breach can spiral into many directions
Kyle Heath, Senior Manager, EY
Shawn Fohs, Managing Director, EY
When smishing and help desk impersonations on unsuspecting corporate users leads to access being hijacked, how many accounts can they get before the attackers are severed from the network?
In this case study, we’ll share our experiences, showcasing how attackers can get in and confuse users and attempt extortion, only to in the end find themselves even burnt out before successfully receiving ransom and losing access to their own copy of the compromised data.
Lessons from real incident response investigations
Miguel Clarke, Special Agent (retired), FBI (Retired)
Anthony DaSilva, Senior Forensic Trainer, Magnet Forensics
Doug Metz, Senior Security Forensics Specialist, Magnet Forensics
Jeff Rutherford, Forensic Consultant, Magnet Forensics
Incident response rarely unfolds exactly as planned. Real investigations are shaped by incomplete information, rapidly changing environments, operational pressure, and the need to make critical decisions while preserving the evidence required to understand what happened.
In this session, retired FBI Supervisory Special Agents Miguel Clarke and Jeff Rutherford, along with Senior Security Forensics Specialist Doug Metz, will draw from real-world incident response investigations to examine the lessons that matter most when responding to complex security incidents. They will explore common investigative challenges, decisions that can affect forensic visibility, and approaches for determining scope, reconstructing attacker activity, and identifying the evidence needed to support containment and remediation.
This isn’t a lecture. Bring your war stories, your toughest calls, and the questions you still argue about with your team. The presenters will bring theirs. Because when the plan stops working, the decisions you make in the first hours determine what the evidence can still tell you.
Public Sector Highlights
No token left behind: Leveraging JSON Web Tokens in digital forensics
Nikos Bilianis, Supervisor/Examiner, Pennsylvania State Police
When a user logs into a web application, the server often issues a JSON Web Token a compact, encoded credential that the browser stores locally and reuses to maintain the session.
These tokens are not just authentication artifacts; their decoded payloads can contain full names, email addresses, IP addresses, device identifiers, session context, and role privilege assignments. Despite being present across nearly every modern browser based application, the forensic value of these stored tokens remains largely untapped in digital investigations.
Current investigative workflows leave JWT claims encoded, requiring examiners to manually decode tokens using external services, or move on without decoding them at all. JWTs are applicable across fraud, insider threat, and ICAC investigations, this presentation demonstrates the investigative value of JWT claims that current workflows fail to surface.
Solving the Gilgo homicides
Kayleigh Homer, Computer Forensic Analyst, Suffolk County DA’s Office
Raymond Tierney, District Attorney, Suffolk County DA’s Office
In December 2010, four sets of human remains were found near Gilgo Beach in Suffolk County, NY. This led to the grisly discovery of six more victims.
On July 13, 2023, the Gilgo Homicides Task Force, established by Suffolk County DA, Raymond A. Tierney, executed search warrants on Rex A. Heuermann’s home and work, and charged him with three murders. The task force seized over 400 electronic devices with 52 TBs of data.
This presentation will delve into forensic methods used to parse through the mountain of data collected and highlight some of the most critical evidence that lead to Heuermann being indicted on four more murders and his subsequent sentencing of three consecutive life sentences without the possibility of parole.
Troubled waters: Verifying digital forensic artifacts beyond parsed output
Jeff Rutherford, Forensic Consultant, Magnet Forensics
Jesse Caloway, Forensic Analyst, Texas Criminal Defense Inv
Digital forensic tools can process enormous amounts of data quickly, but parsed output should not always be the end of the examination. Understanding where an artifact comes from, how it is stored, and how a tool interprets the underlying data is critical to verifying findings and identifying evidence that might otherwise be missed or misunderstood.
This presentation examines real-world iOS and Android examples, including location records recovered from SQLite freelist pages, iMessage Send Later timestamps that can misrepresent when a message was actually drafted vs being sent, and Android location coordinates manually decoded from protobuf data within LevelDB. It will also explore SQLite freelists, database headers, and vacuum settings that may reveal additional recoverable data.
An old MacBook, a locked iPhone, and the evidence that exposed a killer
David Ortiz, Supervisory Special Agent, DACID
This presentation walks through a real-world homicide investigation where the digital forensic analysis of two smartphones proved critical to establishing a timeline, corroborating or contradicting witness statements, and identifying a suspect.
The case involves the death of an U.S. Army soldier, where the primary suspect claimed only brief contact with the victim. Digital evidence told a different story. The breakthrough came from an unexpected source: an old MacBook that had been set aside and nearly overlooked. By leveraging that MacBook, examiners were able to obtain the computers 7-digit PIN and by applying a single-digit correction to derive the actual passcode, the examiner gained full access. What followed was a multi-source forensic examination drawing on GPS/Wi-Fi location records, Apple Health activity data, Bluetooth vehicle connections, messaging databases, and internet search history. Every data source told the same story and none of it matched what the suspect claimed.
You’ve captured the flag — now present it: Magnet Forensics results at trial
Keith Carmy, Unit Supervisor – High Tech and Financial Crimes, Burlington County Prosecutor
Tiffany Lenart, Detective Sergeant/Digital Forensic Examiner, BCPO
A successful digital forensic examination does not end when evidence is recovered. Examiners must also transform complex findings into clear, accurate, and defensible courtroom evidence. This presentation bridges the gap between conducting a digital forensic examination and effectively presenting Magnet Forensics results at trial. Attendees will learn strategies for organizing and validating key Magnet Axiom artifacts, documenting the forensic process, and using timelines, connections, media, reports, and visualizations to explain digital evidence.
The session will also address preparing for testimony, explaining acquisition and analysis methodology, distinguishing extracted data from examiner interpretation, and anticipating cross-examination. Common challenges involving timestamps, deleted data, application artifacts, attribution, tool reliability, and forensic limitations will be discussed, providing a structured approach for turning forensic findings into a clear evidentiary story.
Special Prosecutor track
The critical role of pretrial preparation with digital evidence
Justin Fitzsimmons, J.D., Technical Prosecutions Lead, Magnet Forensics
Kristina Korobov, Bartholomew County Prosecutor’s Office
The courtroom success of a digital investigation doesn’t just depend on what was found, it depends on how well it is prepared and presented before trial. This session will examine the importance of pretrial preparation with digital evidence — from ensuring data integrity and clear reporting to collaborating with prosecutors.
We’ll also discuss the role of the digital forensic expert: anticipating challenges, simplifying complex technical findings for juries, and strengthening case strategy. Attendees will leave with practical approaches for turning digital evidence into courtroom-ready testimony that withstands scrutiny and maximizes impact.
Verifying results for courtroom testimony
Michael Zito, Detective, Montgomery County Police
The days of “trust me, I’m an expert” are long gone and digital forensic artifacts are being challenged in the courtroom. Verifying artifacts is an essential part of the investigative and courtroom process and has become a hot topic in recent years. This presentation will provide guidelines and resources for digital forensic examiners to verify digital forensic artifacts through research and present those findings in the courtroom.
Proof under pressure: Emerging legal battles over digital evidence
Catherine Foresman , Cook County ICAC Commander/ Deputy Supervisor of ICAC , CCSAO
Justin Fitzsimmons, J.D., Technical Prosecutions Lead, Magnet Forensics
Kristina Korobov, Bartholomew County Prosecutor’s Office
Peter Kennedy, Assistant District Attorney, Bronx County District Attorney
Sara Kurtzberg, Chief of Prosecutorial Innovation, Brooklyn District Attorneys Office
Digital evidence places familiar legal principles under new pressure. This panel discussion asks experts about emerging challenges affecting how attorneys obtain, evaluate, and present digital proof. Topics include Chatrie and the evolving limits on geolocation and cell tower warrants; Holcomb and the obligation to reassess a search when probable cause changes; and authentication challenges involving artificial intelligence, altered recordings, and deepfake allegations.
Participants will also examine digital evidence foundations in grand jury proceedings, the limits of summaries and technical testimony, and the legal questions surrounding preservation of vanishing data. Throughout, the discussion connects recent developments to practical decisions about warrant drafting, examiner coordination, evidentiary foundations, and anticipating challenges before they threaten the case.
From report to verdict: Navigating a case built on digital evidence
Justin Fitzsimmons, J.D., Technical Prosecutions Lead, Magnet Forensics
This session provides prosecutors with a clear, start-to-finish understanding of how digital evidence informs and drives a modern criminal case. Beginning with the initial report and investigative steps, participants will examine how digital artifacts are identified, preserved, analyzed, and ultimately used to build a compelling legal narrative.
The session introduces core terminology used in digital evidence extractions and forensic examinations, explains how those processes affect what evidence is available, and demonstrates how to review and interpret results using Portable Case. By the end of this session, participants will be prepared to collaborate effectively with investigators, recognize the evidentiary value of key artifacts, and lay the groundwork for a legally sound and persuasive prosecution.
Join us in Austin for Magnet User Summit 2027!
Need a little help in making the case to attend Magnet User Summit 2027? Download this justification letter to share with your leadership and highlight the value of attending.
Save your spot for Magnet User Summit 2027 and join us in Austin to connect with the digital investigations community, build practical skills, and explore the ideas and approaches shaping investigations today and tomorrow. And keep checking the presentation catalog as we add even more sessions and special guests.
Learn more and register at https://magnetusersummit.com/.