BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidesfrankfurt.org//call-for-paper-presentations-20
 26//speaker//XJ8C7D
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-call-for-paper-presentations-2026-QDB7NB@cfp.bsidesfrankfurt.or
 g
DTSTART;TZID=CET:20260910T110500
DTEND;TZID=CET:20260910T120000
DESCRIPTION:Every Windows release quietly introduces new places where the o
 perating system writes things down\, and Windows 11 is no exception. While
  most DFIR playbooks still lean on the same artifacts we've relied on for 
 a decade\, the modern Windows stack has been busy generating evidence in p
 laces few investigators routinely check. Timelines end up with gaps that d
 idn't need to be there\, and execution evidence sits untouched on disk.\n\
 nDrawing on recurring patterns across hundreds of Windows 11 investigation
 s\, this talk maps the evidence surface that standard triage misses. We'll
  spend time with Recall and the near-continuous record it keeps of user ac
 tivity on Copilot+ devices\, follow the SMS and call history that Phone Li
 nk pulls from paired Android phones onto the Windows host\, and read throu
 gh Copilot conversations where user intent is often spelled out in plain E
 nglish. From there we'll move into the secondary telemetry channels that k
 eep writing long after Event Logs are cleared.\n\nFor each artifact\, we'l
 l cover where it lives\, what it records\, how long it persists\, and the 
 common misreadings that lead investigators astray. Attendees will leave wi
 th a mental model for where Windows 11 records user activity outside the c
 lassic artifact set\, a working understanding of how to parse each source\
 , and a feel for the interpretation pitfalls that matter most at triage ti
 me.
DTSTAMP:20260923T103700Z
LOCATION:Großer Saal
SUMMARY:What Windows 11 Remembers (And Most Investigators Miss) - Maurice F
 ielenbach
URL:https://cfp.bsidesfrankfurt.org/call-for-paper-presentations-2026/talk/
 QDB7NB/
END:VEVENT
END:VCALENDAR