◇ OpenCyber Academy
Bachelor's · Chapter 18 · English

Chapter 18 — Research methods I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Research methods I

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Asking questions"]
  N2["18.2 Literature"]
  N3["18.3 Experimental design"]
  N4["18.4 Variables"]
  N5["18.5 Validity"]
  N6["18.6 Ethics"]
  N7["18.7 Recording"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Asking questions"]
  N2["18.2 Literature"]
  N3["18.3 Experimental design"]
  N4["18.4 Variables"]
  N5["18.5 Validity"]
  N6["18.6 Ethics"]
  N7["18.7 Recording"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Asking questions]
    |
    v
[18.2 Literature]
    |
    v
[18.3 Experimental design]
    |
    v
[18.4 Variables]
    |
    v
[18.5 Validity]
    |
    v
[18.6 Ethics]
    |
    v
[18.7 Recording]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) form a research question about forensic practice; (2) review literature systematically; (3) design a simple experiment; (4) consider validity.

18.1 Asking questions

Leah notices that many artefacts depend on OS version. Question: "Does the ws-114 OS build record program execution in prefetch for programs launched via rundll32, and with what timestamps?"

A good research question is narrow enough to answer with an experiment. Leah's question names one OS build, one launch method and two things to measure: whether an entry exists and how accurate its times are. A broader question, such as "how reliable is prefetch?", could not be answered in one term.

18.2 Literature

She searches for documented behaviour and finds practitioner documentation and peer-reviewed work on Windows artefacts. Garfinkel (2010) argued that forensic research needs standardised data and reproducible methods; Leah applies that by testing on clean virtual machines.

Reading first prevents repeating known work and shows what is still uncertain. Leah records each source, what it tested and on which build, and notes where sources disagree. That list becomes the background of her study and helps her explain why her experiment adds something.

18.3 Experimental design

Build a virtual machine with the same OS build. Launch a synthetic, harmless DLL through rundll32 ten times at recorded times. Examine prefetch afterwards. Compare recorded times with the launch log.

Ten launches give enough repetitions to see whether behaviour is consistent; recording times independently lets her measure accuracy by comparing two sources. Using a harmless test DLL keeps the experiment safe while matching the launch path seen on ws-114. She takes a VM snapshot before each run so she can repeat it from the same state if something goes wrong.

18.4 Variables

Independent: launch method. Dependent: presence and accuracy of prefetch entries. Controls: OS build, settings, clock synchronised.

Keeping controls fixed means that any difference in prefetch results comes from the launch method, not from a changed setting or a drifting clock. Leah records each control's value in her notes, such as the build number and whether prefetch is enabled. A control that changes during the experiment makes the results hard to interpret, so she checks them before and after each run.

18.5 Validity

Internal validity: are differences caused by the launch method? External validity: would results hold on other builds or settings? She limits claims to the tested build.

Internal validity is strengthened by changing only one thing at a time and repeating runs. External validity is limited because she tested one build; a different update or setting might change the behaviour. Limiting claims to what was tested is not weakness but accuracy, and a reader can then decide whether the result applies to ws-114.

18.6 Ethics

No real user data, a harmless test DLL, and isolated virtual machines.

The test DLL does nothing except load, so there is no risk if it escapes the VM. Using no real data means no personal information is exposed in her results. Isolated VMs prevent any test traffic from reaching the university network. Dr Ferreira approves the plan before she starts, and the approval is filed with her notes so that a later reader can see the experiment was authorised.

18.7 Recording

Every step is logged with time and VM snapshot ID so others can repeat it.

Snapshot IDs let her or a classmate restore the exact starting state and repeat a run. Recording launch times from an independent log is what makes the accuracy measurement possible. Her results table lists each run with its snapshot, launch time, prefetch result and difference in seconds, so a reader can check every figure in her summary against the raw records. The table and the snapshots are archived together at the end of the term.

Pilot run

Before the ten recorded runs, Leah does two practice launches to confirm her logging works and the VM clock is synchronised. She discards the practice data, records that she did so, and only then reverts to a clean snapshot for the real trials.

Worked example

Results: prefetch entries appear for rundll32 in all ten runs; last-run times match launch logs within one second. Leah writes: "On this OS build with default settings, prefetch recorded rundll32 executions with last-run times within one second of launch (10 of 10 runs)."

Synthetic case. The experiment is invented.

Errors and limits

Ten runs on one build is a small study; the finding supports interpretation for ws-114, not all Windows systems.

Exercises

Synthesis

Small, well-controlled experiments let examiners interpret artefacts for the exact systems they examine.

Continue studying — chapter 18 of 40

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →