Chapter 10 — Ethics and authorized practice | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Authorisation"]
  N2["10.2 Who authorises"]
  N3["10.3 Scope"]
  N4["10.4 Incidental findings"]
  N5["10.5 Student practice"]
  N6["10.6 Honesty"]
  N7["10.7 Conflicts"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Authorisation"]
  N2["10.2 Who authorises"]
  N3["10.3 Scope"]
  N4["10.4 Incidental findings"]
  N5["10.5 Student practice"]
  N6["10.6 Honesty"]
  N7["10.7 Conflicts"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Authorisation]
    |
    v
[10.2 Who authorises]
    |
    v
[10.3 Scope]
    |
    v
[10.4 Incidental findings]
    |
    v
[10.5 Student practice]
    |
    v
[10.6 Honesty]
    |
    v
[10.7 Conflicts]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) explain why authorisation is the foundation of forensic work; (2) identify who can authorise what; (3) handle incidental findings; (4) apply ethics to student practice.

10.1 Authorisation

Examining a device requires lawful authority: a warrant, owner consent, an employer's policy covering its own equipment, or another legal basis. ISO/IEC 27037 places identification, collection and acquisition within such a framework; without authority, even correct technical work may be unusable and unlawful.

Authority also limits method: a policy permitting examination of a workstation may not permit collecting a user's private email from an external service. Leah learns to ask, before any technical step, what authority covers this device and this data, and to write the answer in the case notes so that it can be checked later.

10.2 Who authorises

For ws-114, the university owns the workstation and its acceptable-use policy permits security investigations. Grace Lin's office acts under that policy. Personal phones of students are not covered; examining them would need the student's consent or legal process.

The distinction matters for evidence found during the investigation: a phone connected to ws-114 by USB leaves records on the workstation, which the university may examine, but the phone's own contents remain outside its authority. Grace's office documents the policy clause it relies on at the start of each case, so the basis for every step can be shown.

10.3 Scope

Authority defines scope: ws-114's disk and university logs, not students' personal cloud accounts.

Scope also covers time and data types: the investigation into the phishing incident covers the relevant days, not the entire history of the machine. Staying within scope protects privacy and keeps the work focused. If the evidence suggests other systems are involved, the team asks for scope to be extended before looking at them, and records the approval with its date and the name of whoever granted it.

10.4 Incidental findings

Examiners may find unrelated private material. They record only what is relevant to the authorised question and follow procedure if they find evidence of serious crimes, which usually means stopping and seeking further authority.

The worked example shows the routine case: personal photos were noted as present but not examined. Recording that decision protects both the student and the investigation, because it shows the team stayed within scope. Serious findings are different and usually require stopping and contacting the appropriate authority before going further. The university's procedure names who must be told and how.

10.5 Student practice

Leah works only on synthetic data and university training images. She never tests tools on friends' devices or public systems.

Testing tools on real devices without authority could break the law and harm people, even with good intentions. Synthetic images and the university's training data give realistic practice without that risk. When Leah wants to try a new tool, she asks Dr Ferreira which training image suits it and records the tool's version and results in her lab notebook for later comparison.

10.6 Honesty

Reporting must be complete and unbiased, including findings that weaken the expected story.

In the ws-114 case, a finding that weakens the phishing story, such as a logon by s.kaur from another building at 09:14, would have to be reported even if it complicated the conclusion. Leaving it out would mislead readers and could cause wrong action against the user, who is already a victim of the attack. Leah's report lists alternative explanations and the evidence for and against each, including those she finally rejected.

10.7 Conflicts

If Leah knew the student using ws-114, she would declare it and step aside from that analysis.

Even if she believes she could stay objective, others may doubt it, and the report's credibility depends on how it looks to them as well. Declaring the conflict early lets Grace assign the work to someone else, while Leah may still help with tasks that do not involve that person. The declaration is written in the case notes with the date and Grace's decision about how to proceed.

Retention and disposal

When the investigation ends, data are kept only as long as policy requires and then securely disposed of, with a record of what was destroyed and when. Holding evidence indefinitely without purpose raises privacy risks.

Worked example

While reviewing ws-114's synthetic image, a team member notices a student's personal photos in a synced folder. They are irrelevant to the phishing question. The team records "personal media present, not examined, not relevant" and continues within scope.

Synthetic case. The finding is invented.

Errors and limits

Policies differ between institutions and countries; check local rules and seek legal advice when unsure.

Exercises

EX028 — Authority for ws-114. What gives the security office authority over ws-114?
Show marking criteria
Rubric: 3 = university ownership and acceptable-use policy; 2 = partial; 1 = curiosity; 0 = none.
EX029 — Personal phone. What is needed to examine a student's personal phone?
Show marking criteria
Rubric: 3 = consent or legal process; 2 = partial; 1 = policy covers it; 0 = none.
EX030 — Photos. How were the personal photos handled?
Show marking criteria
Rubric: 3 = noted present, not examined, out of scope; 2 = partial; 1 = examined; 0 = none.

Synthesis

Authority defines what may be examined; scope and honesty govern how.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →