Chapter 19 — Digital forensics and malware analysis: scope and theory | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Definitions"]
  N2["19.2 Scientific basis"]
  N3["19.3 Process models"]
  N4["19.4 Malware analysis approaches"]
  N5["19.6 Scope of this book"]
  N6["19.7 Professional context"]
  N7["Roles in an investigation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Definitions"]
  N2["19.2 Scientific basis"]
  N3["19.3 Process models"]
  N4["19.4 Malware analysis approaches"]
  N5["19.6 Scope of this book"]
  N6["19.7 Professional context"]
  N7["Roles in an investigation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Definitions]
    |
    v
[19.2 Scientific basis]
    |
    v
[19.3 Process models]
    |
    v
[19.4 Malware analysis approaches]
    |
    v
[19.6 Scope of this book]
    |
    v
[19.7 Professional context]
    |
    v
[Roles in an investigation]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) define digital forensics and malware analysis; (2) explain the scientific basis of forensic conclusions; (3) describe process models; (4) state what forensics cannot do.

19.1 Definitions

Digital forensics applies scientific methods to identify, collect, preserve, examine, analyse and report on digital evidence. Malware analysis determines what a suspicious program does, how it persists and what it communicates with.

The two activities meet in the ws-114 case. Forensics establishes what happened on the workstation and in the logs: the email, the visit to the fake page, the run key. Malware analysis asks what update.dll was built to do, which explains why certain traces exist and where else to look. Each informs the other, and the report keeps their findings clearly labelled.

19.2 Scientific basis

Forensic conclusions rest on tested knowledge about how systems behave, applied with documented methods. Casey (2011) emphasises forming hypotheses and testing them against evidence, including alternatives.

For Leah, tested knowledge includes the prefetch experiment from the research methods chapter: she can now say how her OS build records rundll32 launches because she measured it. Where no such knowledge exists for an artefact, she says so and treats any conclusion from it as weaker. Testing alternatives is the same habit applied to explanations: each is checked against the evidence before one is preferred.

19.3 Process models

NIST SP 800-86 describes collection, examination, analysis and reporting. ISO/IEC 27043 sets out investigation processes from readiness to closure. Both stress documentation at every step.

The models differ in scope. SP 800-86 focuses on the technical steps once data are in hand, while ISO/IEC 27043 adds readiness before incidents and closure after them. For ws-114, readiness would have meant central logs and a reimaging hold, the gaps found earlier; closure means archiving the case and its evidence under the retention schedule. Leah uses both models as a checklist of steps, not as a rigid sequence.

19.4 Malware analysis approaches

Sikorski and Honig (2012) describe static analysis — examining a sample without running it — and dynamic analysis — running it in a controlled lab to observe behaviour. Students begin with static, safe techniques on synthetic samples.

Static analysis of update.dll can show its imports, embedded strings and structure without any risk of it running. Dynamic analysis would show its network contacts and file changes but needs an isolated lab, an approved procedure and supervision. Static work comes first because it is safe and often answers enough questions to guide the rest, such as which domain the sample contacts.

19.5 Limits

Forensics reconstructs events from traces; it can show that an account did something on a system, rarely who was physically present. Missing traces leave gaps that should be stated, not filled with assumptions.

For ws-114 the evidence shows that the account s.kaur was signed in when the spreadsheet launched the DLL chain, not that s.kaur personally clicked anything. Gaps also exist: file share access logs were off, so whether files were taken from shared folders cannot be determined. Leah writes such gaps as limitations in the report rather than guessing, because a reader may act on any statement she makes.

19.6 Scope of this book

The rest of the course follows the ws-114 investigation from first evidence to final report.

Each later chapter takes one step in that investigation: modelling the system, inventorying data, searching indicators, analysing files and memory, verifying results, and finally writing and defending the report. The same synthetic evidence is reused throughout, so improvements in method can be seen against a known baseline. Leah's decisions are shown with their reasons, including the ones she later revises, so readers can follow how the findings were formed.

19.7 Professional context

Examiners work in police labs, companies, consultancies and universities; standards apply to all.

Settings differ in their legal framework and in who receives the report: a police lab writes for courts, a company for its management and possibly regulators, a university security office for its own leadership. The methods taught here, verified copies, documented steps and calibrated conclusions, serve all of them. Leah's work at Harrowgate is an internal investigation, but she writes as if it might one day be examined by an outside expert.

Roles in an investigation

First responders preserve the scene; examiners acquire and examine; analysts interpret; reviewers check. In small teams one person may hold several roles, but the record shows which hat was worn for each action so reviewers can follow responsibility.

Worked example

Grace asks Leah to state the investigation questions: (1) How was ws-114 compromised? (2) What did the malware do? (3) Was any data taken? (4) Were other systems affected? Each will be answered with evidence and stated limits.

Synthetic case. The questions are invented.

Errors and limits

Process models are frameworks; real investigations loop back as new evidence appears.

Exercises

EX055 — Static vs dynamic. Contrast static and dynamic analysis.
Show marking criteria
Rubric: 3 = without running vs controlled execution; 2 = partial; 1 = reversed; 0 = none.
EX056 — Forensic limit. What can forensics rarely show?
Show marking criteria
Rubric: 3 = who was physically present; 2 = partial; 1 = vague; 0 = none.
EX057 — Questions. List the four ws-114 investigation questions.
Show marking criteria
Rubric: 3 = how compromised, what malware did, data taken, other systems; 2 = three; 1 = one; 0 = none.

Synthesis

Digital forensics is applied science with defined processes and honest limits; malware analysis is one of its tools.

Continue studying — chapter 19 of 40

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →