◇ OpenCyber Academy
Bachelor's · Chapter 2 · English

Chapter 2 — Computing systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Components"]
  N2["2.2 Data at rest and in use"]
  N3["2.3 Firmware"]
  N4["2.4 Boot effects"]
  N5["2.5 Shutdown effects"]
  N6["2.6 Peripherals"]
  N7["2.7 Cloud"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Components"]
  N2["2.2 Data at rest and in use"]
  N3["2.3 Firmware"]
  N4["2.4 Boot effects"]
  N5["2.5 Shutdown effects"]
  N6["2.6 Peripherals"]
  N7["2.7 Cloud"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Components]
    |
    v
[2.2 Data at rest and in use]
    |
    v
[2.3 Firmware]
    |
    v
[2.4 Boot effects]
    |
    v
[2.5 Shutdown effects]
    |
    v
[2.6 Peripherals]
    |
    v
[2.7 Cloud]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe the parts of a computer system; (2) explain where data reside at rest and in use; (3) relate components to evidence sources; (4) describe boot and shutdown effects.

2.1 Components

Processor, memory, storage, firmware, input/output devices and network interfaces. Each holds or passes data that an examiner might need.

For ws-114, each component suggests a question: the processor and memory show what was running, the disk shows what was stored and when, the firmware records boot settings and clock, and the network interface shows which hosts the machine talked to. Listing components first helps the examiner plan collection so that nothing is overlooked or destroyed by the order of work.

2.2 Data at rest and in use

At rest, data sit on disks, flash cards and cloud storage. In use, they live in RAM, processor caches and network buffers. RFC 3227 asks collectors to work from the most volatile to the least, because data in use disappear quickly.

For ws-114, this means capturing memory before anything else, since the process running update.dll exists only in RAM while the machine is on. The disk will still be there after capture, but a reboot would erase the process list and any unpacked code in memory.

2.3 Firmware

BIOS or UEFI firmware starts the machine and may hold settings such as boot order and clock time. Examiners often record the firmware clock against a reference to calculate offset.

Suppose the firmware clock reads 10:02 when a reference clock reads 10:00. Every timestamp from that machine's local clock is then about two minutes fast, and the examiner subtracts that offset when building a timeline with other sources such as server logs. Recording the offset at collection time is the only reliable way, because clocks drift and may be reset later.

2.4 Boot effects

Booting a seized computer normally from its own disk writes logs, updates timestamps and may run cleanup tasks. That is why examiners image the disk through a write blocker or boot from trusted external media instead.

A write blocker passes read commands to the disk but blocks writes, so the image matches the disk as seized. The examiner records the blocker model and tests it before use. Hashes of the disk computed before and after imaging should match, which shows that the process did not change anything.

2.5 Shutdown effects

A clean shutdown flushes caches and may delete temporary files; pulling power keeps disk state but loses memory. Choosing between them is a documented decision based on the case.

For ws-114, memory had already been captured, so pulling power to preserve disk state was the better option: a clean shutdown might have let the malware run cleanup tasks on exit. Grace's notes record the time power was removed and the reason, so later readers can understand any gaps in the disk evidence.

2.6 Peripherals

USB drives, printers and phones connected to a computer leave records on the host, such as device connection histories.

On Windows, such records appear in the registry and in setup logs, listing device serial numbers and first and last connection times. If a USB drive was plugged into ws-114 during the incident window, its serial number links the host to that device, which may then be traced to a person. The examiner records which artefacts were checked so absence of records is meaningful.

2.7 Cloud

Some data never reach local storage; they are held by providers and require legal process to obtain.

For ws-114 this could include the victim account's mailbox and any files synced to a university cloud service. The phishing email itself may be held only by the mail provider. The examiner lists such sources early, because preservation requests take time and providers may delete data after a retention period. Asking the provider to preserve records is a separate step from obtaining them, and often comes first.

Worked example

The university security office, led by the fictional Grace Lin, finds a student-lab workstation, ws-114, behaving oddly. A technician wants to reboot it "to see if it fixes itself". Grace stops him: memory may hold evidence of what is running, and a reboot changes the disk. She records the screen, isolates the network cable, and calls for memory capture under the incident procedure.

Synthetic case. ws-114 and the incident are invented.

Errors and limits

Isolating a machine can trigger behaviour in some malware; record the time and action so effects can be interpreted.

Exercises

Synthesis

Every component holds evidence of different volatility; actions on a live system must be chosen and recorded.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →