Chapter 29 — Digital forensics and malware analysis: operations | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 29 — Digital forensics and malware analysis: operations

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Workflow"]
  N2["29.2 Task tracking"]
  N3["29.3 Handovers"]
  N4["29.4 Evidence tracking"]
  N5["29.5 Communication"]
  N6["29.6 Workload"]
  N7["29.7 Closure"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Workflow"]
  N2["29.2 Task tracking"]
  N3["29.3 Handovers"]
  N4["29.4 Evidence tracking"]
  N5["29.5 Communication"]
  N6["29.6 Workload"]
  N7["29.7 Closure"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Workflow]
    |
    v
[29.2 Task tracking]
    |
    v
[29.3 Handovers]
    |
    v
[29.4 Evidence tracking]
    |
    v
[29.5 Communication]
    |
    v
[29.6 Workload]
    |
    v
[29.7 Closure]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) describe the operations of a small investigation team; (2) manage case workflow and handovers; (3) track evidence and tasks; (4) communicate status.

29.1 Workflow

Grace's team uses stages: intake, triage, collection, examination, analysis, review, reporting, closure. A case board shows each case's stage and owner.

Stages make progress visible and prevent steps from being skipped: a case cannot move to reporting until review is done. The case board lets Grace see at a glance which cases are waiting and who holds them. For ws-114, the board showed the case in analysis while static analysis of update.dll was still in progress. Each stage change is dated.

29.2 Task tracking

For ws-114: collect identity logs (done), request mailbox audit (done), static analysis of update.dll (in progress), search for other hosts (done, none found), draft report (pending).

Each task has a status, an owner and a date. Tracking makes dependencies visible: the report waits on static analysis, which is why Q2 is answered only partly in Laboratory II. The search for other hosts is marked done with its result, so nobody repeats it. Tasks that cannot be completed are closed with a reason instead of left open.

29.3 Handovers

When Leah's placement hours end, she hands tasks to a staff analyst with a written note: what is done, where results are, what remains, known issues.

A good handover note lets the next analyst continue without asking questions. Leah's note lists the evidence items she worked on, where her notes are stored, the tasks still open and any issues, such as the pending static analysis. The receiving analyst signs to acknowledge the handover, which also updates custody records for any evidence passed on.

29.4 Evidence tracking

Evidence items have IDs and locations; every move is logged in custody records.

An ID such as EV-007 for the memory capture appears in the inventory, the custody record and every finding that uses it. Moving the evidence, for example to a different storage server, is logged with time, person and reason. When the case closes, the records show where each item ended up and who last held it. If an item cannot be found, that fact is reported, since a gap in custody affects every finding that relies on the item. Regular checks of the evidence store against the records catch such problems early.

29.5 Communication

Daily stand-ups during active incidents; a written status to the CIO at agreed intervals with facts, open questions and next steps.

Status updates separate facts from open questions so the CIO does not mistake a working theory for a finding. For ws-114, an early update might read: "Confirmed: ws-114 compromised via phishing; account s.kaur accessed from abroad, forwarding rule removed at 11:42. Open: whether other data were taken." Next steps and their owners follow, with the time of the next update.

29.6 Workload

Cases are prioritised by risk: an active compromise outranks a policy complaint.

Risk depends on what is at stake now: an active compromise may still be spreading, while a policy complaint can wait a day. Grace reviews priorities each morning. When a new active case arrives, lower-priority work is paused with a note so it can resume cleanly. Recording the decision helps explain delays to those waiting on the paused cases, and shows the choice was deliberate. Paused cases are reviewed again at the next morning meeting.

29.7 Closure

A case closes when questions are answered or the reasons they cannot be answered are documented, recommendations are delivered and evidence retention is set.

For ws-114, closure includes stating that file share access could not be determined because logging was off. Evidence retention is set according to policy, and personal data no longer needed are deleted. A closed case can be reopened if new evidence appears, which is why its records and evidence are kept in order until retention ends.

Tools for coordination

The team uses a ticketing system for tasks and a separate, access-controlled case store for evidence. Mixing them would expose evidence to everyone who can see tickets. Leah notes that tickets refer to evidence by ID only, never by attaching files, and that access to the case store is reviewed whenever team membership changes. The rule is written into the team's procedures so new members follow it from their first day.

Worked example

The CIO asks at 14:00 whether data were stolen. Grace's status note: "Known: s.kaur's mailbox forwarded 37 messages externally between 10:05 and 11:40; rule removed at 11:42. Unknown: file share access (logging off). Next: review forwarded message list with the data protection officer."

Synthetic case. The status is invented.

Errors and limits

Status updates under pressure risk overstating certainty; separate known from unknown explicitly.

Exercises

EX085 — Handover note. What does Leah's handover note contain? Rubric: 3 = done, location of results, remaining, issues; 2 = three; 1 = one; 0 = none.
EX086 — Status structure. How is the CIO status note structured? Rubric: 3 = known, unknown, next; 2 = two; 1 = narrative; 0 = none.
EX087 — Closure criteria. When does a case close? Rubric: 3 = questions answered or reasons documented; recommendations delivered; retention set; 2 = two; 1 = one; 0 = none.

Synthesis

Clear stages, tracked tasks, written handovers and known/unknown status keep investigations under control.

Continue studying — chapter 29 of 40

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →