Speaking & Training

Talks and training on incident response and digital forensics

A record of conference talks, training courses, and webinars on incident response, digital forensics, and investigative reasoning, going back to the start of my career in law enforcement forensics.

Get in touch about speaking

Upcoming

Where to see me next

2026 Nov 4: Panelist, “Cybercrime Event Data Exchange Semantics and Logistics”
APWG eCrime Symposium · Lisbon, Portugal
2026 Dec 8: MasterClass, “From Artifacts to Evidence: Building Defensible Conclusions in Incident Response”
Black Hat Europe · London, UK · with Duncan Gardiner

Recurring instruction

Ongoing and multi-year teaching roles

Ongoing: Technical Instructor, Cellebrite
Digital forensics tool training
2011–2025: Assistant Professor / Adjunct Lecturer, NTNU
Gjøvik, Norway · master’s-level digital forensics and incident response courses
2004–2012: Instructor and curriculum lead, IACIS
Advanced Windows Forensics course · biannual training events

Past engagements

Speaking and training history

2026 Sep 3: “What We Knew at the Time”
RBLN Europe · Amsterdam, Netherlands
2026 Mar 19–20: “Why Most Incident Reports Don’t Survive Scrutiny (And How to Fix That)”
Warsaw IT Days · Warsaw, Poland · delivered online and in person
2022 Oct: “Pay Up or Else”
it-sa · Nuremberg, Germany
2020 Sep–Oct: “How Was That Breach Detected?”
HTCIA International Conference & Expo · delivered virtually
2019 Dec: Round table, “Beyond Malware: What Characteristics and Behavioral Traits Can Identify Attackers in a Network?”
Security Interest Group Zurich · Zurich, Switzerland
2018 Oct: “1+1 is Not Always 2: Bypassing Multi-Factor Authentication”
SANS Prague Summit · Prague, Czech Republic · with James Hovious
2018 Oct: “How Was That Breach Detected?”
FireEye multi-customer event · Istanbul, Turkey
2018 Sep: “How Was That Breach Detected?”
Security Interest Group Zurich · Zurich, Switzerland
2017 Oct 4: “How Was That Breach Detected?”
UISGCON13 · Kyiv, Ukraine
2017: “How Was That Breach Detected?”
SANS Prague Summit · Prague, Czech Republic
2017 Sep 13–14: “How Was That Breach Detected?”
Security Case Study (SCS) · Warsaw, Poland
2017 Mar 20–24: “What the Shell? Powering through PowerShell Forensics”
CeBIT · Hannover, Germany
2014 Oct 14–15: Trainer, “Incident Response – Black Hat Edition”
Black Hat Europe · Amsterdam, Netherlands · with Christopher Glyer and Tyler Oliver
2010 Oct: “exFAT History”
F3, the First Forensic Forum · United Kingdom
2010 Jul 8–9: “exFAT History”
SANS Forensics Summit · Washington, D.C.
2010 May: “exFAT History”
CEIC · Las Vegas, Nevada
2003: “Internet Safety”
Oakland County Sheriff’s Office community talk · Michigan, USA
2002: “Internet Predators”
Oakland County Sheriff’s Office community talk · Michigan, USA
2001–03: “First Response to Computer Crime”
Oakland County Computer Crimes Unit training · Michigan, USA · with Det. Carol Liposky
2001: “Search and Seizure of Computer Evidence”
Oakland County Computer Crimes Unit training · Michigan, USA · with an Assistant Prosecuting Attorney
2001: “OCICTF: Computer Crimes and Evidence, Law Enforcement Issues”
Oakland County Internet Crimes Task Force · Michigan, USA

This list covers public talks and training courses. It leaves out client-specific briefings and incident debriefs, which stay confidential to the engagement.