Chapter 21 — Digital forensics and malware analysis: system models
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Why model first"]
N2["21.2 Mapping questions to sources"]
N3["21.3 Dependencies"]
N4["21.4 Gaps"]
N5["21.5 Trust boundaries"]
N6["21.6 Living model"]
N7["21.7 Sharing the model"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Why model first"]
N2["21.2 Mapping questions to sources"]
N3["21.3 Dependencies"]
N4["21.4 Gaps"]
N5["21.5 Trust boundaries"]
N6["21.6 Living model"]
N7["21.7 Sharing the model"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Why model first]
|
v
[21.2 Mapping questions to sources]
|
v
[21.3 Dependencies]
|
v
[21.4 Gaps]
|
v
[21.5 Trust boundaries]
|
v
[21.6 Living model]
|
v
[21.7 Sharing the model]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) model the ws-114 environment as a system of components and data flows; (2) identify where each investigative question can be answered; (3) map evidence sources to questions; (4) find gaps before analysis.
21.1 Why model first
Before diving into artefacts, Leah sketches the system: user, workstation, email service, proxy, identity provider, file share, internet. Arrows show data flows. The model tells her where evidence about each question should exist.
Without a model, examiners tend to start with the artefacts they know best and miss sources they do not think of. For ws-114, the model showed that the identity provider and the mailbox were part of the incident, not just the workstation, which led to the foreign sign-in and the forwarding rule. Drawing the arrows takes minutes and shapes days of work.
21.2 Mapping questions to sources
Q1 (how compromised): email gateway, browser history, proxy, endpoint file and process artefacts. Q2 (what malware did): endpoint persistence, memory, static analysis of update.dll. Q3 (data taken): proxy volumes, identity logs, mailbox rules, file share access logs. Q4 (other systems): firewall, proxy and identity logs for other hosts and accounts.
Some sources answer several questions: the proxy contributes to Q1, Q3 and Q4. That makes it the first source to verify and clock-check, since an error there would affect three answers at once. Q3 depends partly on file share logs that, as the next part shows, were not available.
21.3 Dependencies
Some answers depend on others: identifying the malware's network destinations (Q2) lets the team search proxy logs for other hosts contacting them (Q4).
In ws-114 the dependency was real: static analysis of update.dll pointed to cdn-update.example.org, and searching the proxy logs for that domain was how the team checked other hosts. Recording dependencies helps plan the order of work. Tasks that unlock others, such as identifying the DLL's destinations, are done first, while independent tasks can run in parallel by different team members. Grace's team uses the list to assign work at each morning meeting.
21.4 Gaps
File share access logging was disabled for student folders. Q3 may be only partly answerable for file share data; Leah notes the gap now rather than discovering it during reporting.
Stating the gap early changes the work: the team looks for other evidence about file access, such as proxy upload volumes or mailbox forwarding counts, instead of assuming the question can be answered. It also feeds the recommendations later, since enabling file share logging is one of the controls the report proposes. Readers of the final report see the gap described in the same words it was first recorded in.
21.5 Trust boundaries
The model marks where data leave university control — the fake login site, the external forwarding address — because evidence beyond those boundaries requires other routes.
The fake login site is run by the attacker, so its logs are out of reach; evidence about it comes from the university side, such as proxy records of the POST. The external forwarding address belongs to another provider, which might be asked for information only through legal channels. Marking these boundaries tells Grace's team where their own evidence ends and where requests to others would be needed.
21.6 Living model
As evidence arrives, the model is updated: a newly discovered connection to cdn-update.example.org adds an arrow.
Keeping the model current means each new finding is checked against it: does it fit an existing arrow, or does it reveal a flow nobody expected? The cdn-update.example.org connection added a path from ws-114 to the internet that explained where update.dll came from. Leah dates each version of the diagram so the report can show how understanding developed during the investigation.
21.7 Sharing the model
The diagram goes into the case file and is reviewed with Grace's team.
Reviewing the diagram with the people who run the systems catches mistakes, such as a missing log source or a data flow that does not exist. Grace's network administrator points out that software configured to bypass the proxy would reach the internet directly, so such traffic would appear in firewall logs but not proxy logs. The diagram gains an arrow from ws-114 through the firewall, and Leah adds the firewall export to her search for the two domains' addresses.
Worked example
Leah's evidence matrix has questions as rows and sources as columns, each cell marked available, partial or missing. The Q3/file-share cell is "missing (logging off)". Grace uses the matrix to request mailbox audit logs from the email provider early, before retention expires.
Synthetic case. The model is invented.
Errors and limits
Models reflect what the team knows; unknown systems (a personal phone, an unmanaged device) will not appear until discovered.
Exercises
- EX061 — Sources for Q3. Which sources address data taken? Rubric: 3 = proxy volumes, identity logs, mailbox rules, file share logs; 2 = two; 1 = one; 0 = none.
- EX062 — Dependency. How does Q2 help answer Q4? Rubric: 3 = malware destinations searched across other hosts; 2 = partial; 1 = vague; 0 = none.
- EX063 — Early request. Why did Grace request mailbox audit logs early? Rubric: 3 = before provider retention expires; matrix showed need; 2 = partial; 1 = habit; 0 = none.
Synthesis
A system model and evidence matrix show where answers live, what depends on what, and which gaps to address early.
Continue studying — chapter 21 of 40
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →