February 2017 Chapter Meeting

February brings us Superbowl Sunday, Presidents’ Day, and the RSA Conference out in San Francisco! To reflect the RSA conference, we are moving our usual third Thursday of the month chapter meeting date to Thursday, February 23rd. If you’re not headed out to RSA, check out the agenda here and see if you can catch any of their videos from afar: https://www.rsaconference.com/events/us17.

Our February speaker will be Jeffrey Williams, presenting on utilizing Vagrant for a digital forensics tool that he designed.

Incident Responders are always on the lookout for tools that will allow investigation work to become more efficient. There are already a ton of great tools and pre-configured virtual images that offer workable forensics environments on the market. It doesn’t hurt to have more than one trustworthy option when it comes to these resources.

Vagrant is a virtual management platform used to create and deploy virtual environments. Although it’s more commonly used by developers for testing, Jeff thought about how he could leverage it for his DFIR needs. His goal was to provide a quick deployable forensics environment while leveraging the Vagrant platform. Dreamcatcher was born.

The Dreamcatcher project was shaped with a lightweight memory forensics environment in mind, and since then he has added more tools and features to its arsenal. As his contribution to the variety of DFIR “Swiss Army Knives” available, it is a fast, flexible alternative. With a clear list of ingredients – no hidden preservatives! – Jeff will demonstrate why Dreamcatcher is a great DFIR addition to anyone’s toolkit.


Jeff Williams (@blu3wing on Twitter) is a Security Engineer working in Healthcare and specializes in DFIR and Malware Hunting. He is in the process of completing his Bachelor’s degree in Information Assurance at Eastern Michigan University, where he plans to finish his last two remaining classes over the Summer and Fall 2017 semesters. He is passionate about all things InfoSec, and spends most of his free time researching and monitoring security related events and news.

If you would like to download the tool ahead of time and bring questions about it to the talk, you can do so here: https://atlas.hashicorp.com/blu3wing/boxes/dreamcatcher.


Attending this meeting earns you 1 CPE.

The meeting doors will be opened at 7:45 AM for sign-in and networking, followed by our speaker’s presentation at 8:00 AM.

Please note our fee for attending this meeting:

  • Current members of ISSA International: meetings are included in your membership!
  • Friends & guests of the Lansing ISSA chapter: $10
  • Students & first time guests: free!

Register for the February Chapter Meeting here!

Hope to see you there!

Lansing ISSA Board

The Lansing ISSA chapter appreciates the location sponsorship of MSUFCU!

MSUFCU LogoTagline_Green-small