2016 Presentations: SANS DFIR Summit (Austin, TX) Start-Process -Name PowerShell | Get-ForensicArtifact [Abstract | Slides] PowerShell Conference Europe (Hannover, Germany) Start-Process -Name PowerShell | Get-ForensicArtifact [Abstract | Slides | Video] Creating an Agent-less IDS using WMI and PowerShell [Abstract | Slides] PowerShell & DevOps Global Summit (Bellevue, WA) Old Dog, New Tricks: Forensics with PowerShell [Abstract | Slides | Video] Creating an Agent-less IDS using WMI and PowerShell [Abstract | Slides | Video] NYC IT Pro Con (New York, NY) [Abstract | Slides] 2015 Presentations: B-Sides DC (Washington DC) **** It, Do it Live (PowerShell Digital Forensics) [Abstract | Slides | Video] 44CON London (London, England) Old Dog, New Tricks: Forensics with PowerShell [Abstract | Slides | Video] 2014 Presentations: SANS DFIRCON (Monterey, CA) A 10 Second Journey: Parsing the structure of the Windows 8 Prefetch Artifact [Abstract | Slides]