Chapter 22 — Digital forensics and malware analysis: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Inventory"]
N2["22.2 Provenance"]
N3["22.3 Reliability dependencies"]
N4["22.4 Collection order"]
N5["22.5 Completeness"]
N6["22.6 Integrity"]
N7["22.7 Formats"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Inventory"]
N2["22.2 Provenance"]
N3["22.3 Reliability dependencies"]
N4["22.4 Collection order"]
N5["22.5 Completeness"]
N6["22.6 Integrity"]
N7["22.7 Formats"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Inventory]
|
v
[22.2 Provenance]
|
v
[22.3 Reliability dependencies]
|
v
[22.4 Collection order]
|
v
[22.5 Completeness]
|
v
[22.6 Integrity]
|
v
[22.7 Formats]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) inventory evidence data sets; (2) record their provenance; (3) understand how one data set's reliability affects others; (4) plan collection order.
22.1 Inventory
The ws-114 case data: disk image (SHA-256 recorded), memory capture, email message with headers, proxy logs for 09:00–12:00, identity provider sign-ins for s.kaur over seven days, mailbox audit log, firewall logs. Each entry lists source, collector, time, hash and format.
The inventory is the investigation's index: every finding later cites an entry by its identifier. Recording the format matters because some exports are text, others proprietary, and a reviewer needs to know which tool reads them. Seven days of sign-ins rather than only the incident day lets the team check for earlier suspicious activity on s.kaur's account.
22.2 Provenance
Where did each data set come from, who exported it, and how? Proxy logs exported by an administrator via the console are recorded with that administrator's name, export query and time.
If the proxy logs were later questioned, the administrator's name, query and export time let someone reproduce the export and compare. An export from an unknown source, perhaps sent by email without notes, would be much weaker. Leah asks for provenance details at the moment she receives data, because they are hard to reconstruct weeks later.
22.3 Reliability dependencies
Timelines combine sources; if the proxy clock is wrong, every proxy-derived time is wrong. Leah checks each source's clock: the proxy is synchronised to network time; ws-114 ran 47 seconds slow.
Checking each source's clock is quick when done early and expensive when done late. A proxy synchronised to network time can serve as the reference against which endpoint times are compared. If the identity provider used a different time zone in its export, its times would be shifted by whole hours, which Leah checks by looking for an event that appears in both the identity log and the proxy, such as a sign-in page request.
22.4 Collection order
Volatile and expiring data first: memory (already captured), identity logs (30-day retention), mailbox audit (90 days), then less urgent sources. RFC 3227's volatility principle extends naturally to retention deadlines.
The identity logs, with 30-day retention, were the most urgent export after memory: had the investigation waited a month, the 10:02 foreign sign-in would have been deleted. The mailbox audit log at 90 days left more time but was collected the same week. Leah lists each source's retention beside its collection date to show nothing was at risk of expiring.
22.5 Completeness
Each export records the query and time range so gaps are visible; "proxy logs 09:00–12:00" means nothing outside that window was examined.
A finding that no other host contacted the indicators holds only for the logs searched. If the domain had been contacted at 12:30, outside the 09:00–12:00 export, the search would miss it. Leah notes the window beside each negative result and requests a wider export when a question depends on later activity, such as whether the malware contacted its server again after isolation.
22.6 Integrity
Every exported file is hashed on receipt.
Hashing on receipt records the state of the file when it reached Leah; any later change shows up as a mismatch. The hash goes into the inventory entry beside the export details. When a file is passed to another examiner, the receiver hashes it again and compares, which shows the transfer did not alter it. This is the same principle applied to the disk image, extended to every log export, however small or routine the export appears.
22.7 Formats
Native formats are kept alongside any converted versions.
Converting a proprietary log to CSV makes analysis easier but can lose fields or change time formats. Keeping the native file lets a reviewer return to the original if a conversion is questioned. Leah records the conversion tool and its version, and checks a few converted rows against the native file by hand. If a field was dropped, she notes it so later readers know what the CSV lacks and can go back to the native file.
Derived data
Some data are produced by the team: parsed CSVs, timelines, reports. Each derived file records which inputs and script version produced it, so any figure can be regenerated from the original sources if questioned.
Worked example
Merging proxy and endpoint times, Leah first adds 47 seconds to ws-114's times. Uncorrected, the run key reads 09:30:20, before the proxy's 09:31:02 download of the DLL; corrected, the download precedes it by a few seconds, a sequence that makes sense.
Synthetic case. The inventory is invented.
Errors and limits
Provenance records rely on the honesty and care of those exporting data; independent sources help cross-check.
Exercises
- EX064 — Inventory fields. List the fields recorded for each data set. Rubric: 3 = source, collector, time, hash, format; 2 = three; 1 = one; 0 = none.
- EX065 — Clock effect. What happened when ws-114 times were not corrected? Rubric: 3 = run key appeared before download; impossible order; 2 = partial; 1 = vague; 0 = none.
- EX066 — Collection priority. Why collect identity logs before firewall logs? Rubric: 3 = shorter retention, expiring first; 2 = partial; 1 = random; 0 = none.
Synthesis
Inventory, provenance and clock checks make combined analysis trustworthy; collect what expires first.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →