About the Workshop
Digital evidence now sits at the centre of how we investigate crime, respond to cyber incidents, and settle disputes over what was actually said, shown, or shared. Messaging apps, social platforms, and synthetic media have multiplied the volume of that evidence while making its origin and integrity harder to establish. Forensic readiness, the capacity to collect, preserve, and rely on digital evidence before an incident rather than scrambling after one, has become a precondition for trust in social communications.
This one-day workshop, hosted by the UQ Cyber Research Centre at The University of Queensland, brings investigators, practitioners, clinicians, and researchers together to work through where forensic practice needs to go next. The forenoon track examines the problems law enforcement faces with volatile, encrypted, and manipulated evidence. The afternoon track turns to healthcare, where forensic readiness is part of keeping clinical systems running and patient data protected through and after a cyber incident.
Each track pairs keynote addresses from industry and academic leaders with live demonstrations of student research projects from our centre, so that open problems are discussed alongside working tools and prototypes.
The day also serves as a showcase for our AEA Ignite research on the Authentication and Provenance of Manipulated Media (APMM). That work builds tools to establish whether images, video, and documents circulating on social platforms have been altered and where they came from, the same question of evidential trust that runs through both tracks.
Workshop Structure
The day is split into a forenoon and an afternoon track. Each opens with keynote addresses and closes with live demonstrations of student research projects.
Investigators now handle evidence that is volatile, spread across cloud services and endpoints, frequently encrypted, and increasingly fabricated. This track examines live response and endpoint visibility at scale, acquisition of evidence from devices and social platforms, authentication of images, audio, and video presented as evidence, and the standards that keep digital findings admissible.
Keynotes: Mike Cohen, Prof. Parag Rughani
Demos: Jack, Noah, Minkyung, Aditya, Anurag
Hospitals and health providers run on connected clinical systems, medical devices, and shared patient records, and an incident in any of them is a patient safety issue as much as a data breach. This track treats forensic readiness as a resilience capability: evidence preservation designed into clinical environments, investigation that does not interrupt care, and the integrity of medical data and imaging.
Keynotes: Prof. Rajat Subhra Chakraborty, Matt Walker, Marc Sarossy (to be confirmed)
Demos: Gagandeep, Harshith, Samudi, Gaurav
Workshop Focus
Three questions run across both tracks and frame the discussion that follows each keynote and demonstration.
Planning evidence collection, logging, retention, and chain of custody before an incident occurs, so that organisations can answer what happened quickly and defensibly instead of reconstructing it from whatever survived.
Establishing the provenance and authenticity of messages, images, voice, and video shared across social platforms, including detection of manipulated and synthetic media, provenance verification, and the evidential weight such content can carry. This is the core question behind our AEA Ignite APMM research.
Forensic investigation that supports recovery rather than delaying it, with particular attention to healthcare settings where systems must stay available, patient data must stay protected, and findings must feed back into stronger defences.
Invited Speakers
Programme
Wednesday, 18 November 2026 · 50-C207, Hawken Engineering Building, The University of Queensland · 9:00 AM AEST onwards · Timings are provisional and will be finalised closer to the date.
| AEST / Brisbane | Session |
|---|---|
| 9:00 AM – 9:15 AM | Welcome and Opening |
| Track 1 · Forensics Challenges for Law Enforcement | |
| 9:15 AM – 9:55 AM | Keynote: Mike CohenRapid7 |
| 10:00 AM – 10:40 AM | Keynote: Prof. Parag RughaniNational Forensic Sciences University, India |
| 10:40 AM – 11:00 AM | Morning Tea |
| 11:00 AM – 12:15 PM | Student Project DemonstrationsJack, Noah, Minkyung, Aditya, Anurag |
| 12:15 PM – 1:15 PM | Lunch |
| Track 2 · Forensics to Build Cyber Resilience for Health Care | |
| 1:15 PM – 1:55 PM | Keynote: Prof. Rajat Subhra ChakrabortyIIT Kharagpur, India |
| 2:00 PM – 2:40 PM | Keynote: Matt WalkerCyberAgile |
| 2:45 PM – 3:25 PM | Keynote: Marc SarossyTo be confirmed |
| 3:25 PM – 3:40 PM | Afternoon Tea |
| 3:40 PM – 4:40 PM | Student Project DemonstrationsGagandeep, Harshith, Samudi, Gaurav |
| 4:40 PM – 5:00 PM | Synthesis and Closing |
Student Research
Students from the UQ Cyber Research Centre demonstrate working prototypes from their research at the close of each track, including work developed under our AEA Ignite project on the Authentication and Provenance of Manipulated Media.
Following Track 1 · Forenoon
Following Track 2 · Afternoon
Participating Institutions
.png)