Chapter 25 — Laboratory I | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Laboratory I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Lab setup"]
  N2["25.2 First step: verify"]
  N3["25.3 Structured examination"]
  N4["25.4 Notes"]
  N5["25.5 Safety"]
  N6["25.6 Peer check"]
  N7["25.7 Time management"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Lab setup"]
  N2["25.2 First step: verify"]
  N3["25.3 Structured examination"]
  N4["25.4 Notes"]
  N5["25.5 Safety"]
  N6["25.6 Peer check"]
  N7["25.7 Time management"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Lab setup]
    |
    v
[25.2 First step: verify]
    |
    v
[25.3 Structured examination]
    |
    v
[25.4 Notes]
    |
    v
[25.5 Safety]
    |
    v
[25.6 Peer check]
    |
    v
[25.7 Time management]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) set up a safe forensic lab workstation; (2) verify an image before analysis; (3) run a first structured examination; (4) keep lab notes to standard.

25.1 Lab setup

The teaching lab uses offline workstations with validated tools, a write blocker for physical media, and storage for synthetic images. Internet access is disabled on analysis machines. Malware-related exercises use isolated virtual machines with snapshots.

Each element protects something. Offline workstations stop a suspicious file from reaching the internet if it is opened by mistake. Validated tools give results that can be trusted. Snapshots let a VM be returned to a clean state after each exercise. Leah checks the lab's setup sheet at the start of each session and notes the tool versions she will use.

25.2 First step: verify

Leah receives a synthetic training copy of the ws-114 image with its acquisition SHA-256. She hashes her copy: match. She records date, time, tool and result in her notes before doing anything else.

Verifying first means every later finding rests on a copy known to match the original. If the hashes had differed, she would stop, report the mismatch and request a fresh copy rather than proceed. Recording the result before any analysis also shows the order of her work, which matters if someone later asks whether the copy was altered during examination.

25.3 Structured examination

She follows a checklist: partition layout; OS version and time zone settings; user accounts; recent activity in the incident window; persistence locations; downloads folder; browser history; event logs. Each item records findings or "nothing found" with the source.

Starting with partition layout and OS settings establishes the facts every later finding depends on, such as the time zone and the clock offset. Recording "nothing found" is as important as recording findings: it shows that a location was checked. The worked example shows her notes following this order, with times beside each step.

25.4 Notes

Notes are contemporaneous, dated, and state actions and observations separately. Screenshots are named and referenced.

Separating actions from observations means a reader can tell what Leah did ("opened the run key in the registry viewer") from what she saw ("value Updater points to rundll32 update.dll"). Mixing them makes it hard to judge what was observed directly. Screenshots named by finding number, such as F6, link each image to its line in the notes and to the report. Leah writes the notes as she works, never afterwards.

25.5 Safety

Suspicious files are exported only into password-protected archives on the isolated analysis VM, never opened on the examination workstation.

Password-protected archives stop the file from being opened accidentally and stop some security tools from deleting it. Keeping it on the isolated VM means that even if it were opened, it could not reach other machines. In the worked example, Leah's note for the run key ends with "Not opened", which records that she followed this rule for update.dll on her first pass.

25.6 Peer check

A classmate reviews her notes against the checklist and repeats two findings independently.

Repeating two findings independently tests whether Leah's notes are complete enough for someone else to follow. If the classmate cannot reproduce a finding from the notes, the notes are missing something, even if the finding is correct. Disagreements are recorded and resolved, and the lab grade gives credit for this process, not only for the findings. In Leah's lab, the classmate repeated the run key and the Downloads listing and matched both, but found that her note on browser history did not name the profile examined; she added it.

25.7 Time management

Lab sessions are timed; unfinished items are listed for the next session, not guessed.

Guessing under time pressure is how unsupported findings enter reports. Listing unfinished items, such as "event logs for 09:30–10:00 not yet reviewed", makes the gap visible and lets the next session start where this one ended. In a real case, the same habit prevents a deadline from turning an open question into a confident but untested statement. Leah's list for the next session is the first thing she reads when she sits down again.

Tool familiarity

Before using a tool on the training image, Leah reads its documentation and runs it on a tiny synthetic image whose contents she knows. If the tool's output disagrees with what she planted, she investigates before trusting it on the case image, and notes the check.

Worked example

Leah's notes: "10:02 — verified copy SHA-256 matches acquisition. 10:10 — OS build recorded; time zone set to UTC+0. 10:25 — Downloads: Q1_budget.xlsm and update.dll present. 10:40 — run key HKCU…\Run value 'Updater' → rundll32 update.dll. Not opened."

Synthetic case. The training image is synthetic.

Errors and limits

Checklists ensure coverage of known places; novel artefacts may lie elsewhere.

Exercises

EX073 — First action. What is the first action on receiving the image? Rubric: 3 = verify hash against acquisition and record; 2 = partial; 1 = browse files; 0 = none.
EX074 — Suspicious files. How are suspicious files handled in the lab? Rubric: 3 = exported to protected archive on isolated VM, never opened on workstation; 2 = partial; 1 = opened; 0 = none.
EX075 — Peer check. What does the peer check involve? Rubric: 3 = review notes vs checklist; repeat two findings; 2 = partial; 1 = proofreading; 0 = none.

Synthesis

Verify first, follow a checklist, keep proper notes, handle samples safely and have work checked.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →