top of page

Open Memory Forensics Workshop (OMFW)

Volatile memory forensics (ie., RAM forensics) has proven one of the most exciting and important topics to the future of digital investigations. It has dramatically transformed the way we perform digital investigations and helped provide a path for addressing many of the challenges currently facing the digital forensics community.


OMFW is the only digital forensics workshop focused on providing a venue for the most advanced digital investigators. It is intended for those people who realize that the only real defense against a creative technical human adversary is a creative technical human analyst. No shady vendors trying to describe how they re-implemented open source tools or boisterous trainers attempting to discuss topics they only superficially understand. This is your opportunity to learn directly from an international cadre of pioneering researchers and practitioners who have been shaping the field of memory analysis since its inception. Through a series of invited talks and panel discussions you will have the opportunity to engage this exciting community.

Join with industry leaders to discuss the latest advancements in memory forensics and the importance of open source initiatives. This is your opportunity to help shape the future of memory forensics!




"The OMFW was well… mind blowing for the most part. The amount of knowledge the Volatility guys (and girl) have is insane." Glenn P. Edwards Jr. (


"For the last four years the Open Source Memory Forensics Workshop (OMFW) has hosted a collective who’s who of memory forensics and provided a forum in which to discuss the latest advances and tools." Mike Webber (


"AAron was able to bring together an outstanding group of folks interested in "memory forensics" and there was some spirited discussion among the participants along with some really outstanding talks/demos. It was also great to be able to put faces to folks who until then had only been handles in IRC or names on e-mail/blog posts in the past." Jim Clausing


"My first impression of the event was that the underground could have set digital forensics back 3-5 years if they had attacked our small conference room. Where else do you have Eoghan Casey, Brian Carrier, Harlan Carvey, Michael Cohen, Brendan Dolan-Gavitt, George Garner Jr., Andreas Schuster, Aaron Walters, et al, in the same room? I thought Brian Dykstra framed the situation properly when asking the following: "I know this is an easy question for all you 'beautiful minds,' but..."" Richard Bejtlich


What Makes OMFW Different?


  1. Conference Size: OMFW is intended to be an intimate venue to encourage participation and collaborative discussions. Thus, we limit the number of attendees in order to have the highest speaker to participant ratio of any security conference.

  2. Technical Content: OMFW is the most technical conference you will attend in the area of digital forensics. While I know some people (ie Hi Rob!) believe that forensic content should be simplified to make it more accessible to the general public, we believe the only way to grow as an industry is to push people beyond what they are comfortable with. The goal is to help people develop the skills required to deal with the modern digital adversary.

  3. Peer Relationships: Another major goal of OMFW is to help attendees build relationships with the people actually doing the innovative research in the area of memory analysis. These are the people you will turn to when you are facing a challenging problem or when you need to bounce an idea off of someone. They are the developers who actually did the research and built the tools.

  4. Expert Researchers and Practitioners: OMFW is intended to bring together both practitioners and researchers. It is an opportunity to learn what innovative research is being done in memory analysis and what current challenges investigators are facing. In fact, many of the speakers were chosen for their unique ability to combine real world experience and innovative research.

  5. Cost: Unlike many forensics conferences or memory analysis trainings which are overpriced money making schemes, the goal of OMFW is to further the memory forensics community. Given the limited number of attendees, we have decided to charge a $50 fee to discourage people from registering and not showing up. 100% of the proceeds collected are donated to charity!

  6. Lightening Talks: Unlike most conferences with drawn out presentations, OMFW asks invited speakers to present talks that are focused and full of great information. Thus, presentations are limited to 30 minutes. At the end of each talk, time is set aside to engage each speaker about specific details of their presentation.

  7. No Commercial Exploiters: In recent years, there has been a growing number of shady vendors entering the digital forensics/incident response industry. If you currently work for one of these vendors or have in the past, we request that you do not attempt to attend. Your business practices have already negatively affected the openness and sharing of the digital forensics community. You know who you are!

bottom of page