Chapter 30 — Laboratory II | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 Scope"]
  N2["30.2 Procedure"]
  N3["30.3 Findings list"]
  N4["30.4 Answering questions"]
  N5["30.6 Review"]
  N6["30.7 Assessment"]
  N7["Pair work discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 Scope"]
  N2["30.2 Procedure"]
  N3["30.3 Findings list"]
  N4["30.4 Answering questions"]
  N5["30.6 Review"]
  N6["30.7 Assessment"]
  N7["Pair work discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 Scope]
    |
    v
[30.2 Procedure]
    |
    v
[30.3 Findings list]
    |
    v
[30.4 Answering questions]
    |
    v
[30.6 Review]
    |
    v
[30.7 Assessment]
    |
    v
[Pair work discipline]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) conduct a full examination of the ws-114 training image; (2) produce a findings list with sources; (3) answer the investigation questions within limits; (4) submit work for review.

30.1 Scope

Laboratory II covers the complete synthetic ws-114 image, memory capture and logs. Students work in pairs but write individual findings.

Working in pairs allows discussion of methods, while individual findings ensure each student can defend their own work. The full image and logs mean students face the same volume and noise as a real case, including irrelevant files and events. Dr Ferreira provides the acquisition hashes and asks each student to verify them before starting work, exactly as in Laboratory I.

30.2 Procedure

Verify all inputs. Establish system facts (OS build, time zone, accounts, clock offset). Build the timeline for 09:00–12:00 UTC. Examine email, browser, downloads, persistence, memory processes and network records. Record every finding with its source and the tool used.

The order matters: system facts come first because the timeline depends on the time zone and the clock offset. The window 09:00–12:00 covers the email delivery through containment. Recording the tool for every finding allows the verification table to be built later without retracing steps.

30.3 Findings list

F1 phishing email delivered 09:12. F2 data POSTed to fake page 09:14:30. F3 Q1_budget.xlsm saved 09:15:10. F4 EXCEL → cmd → rundll32 process chain. F5 update.dll downloaded 09:31:02 and written 09:31:05. F6 run key created 09:31:07. F7 foreign sign-in to s.kaur 10:02. F8 forwarding rule 10:05–11:42.

Each finding is numbered so the report can cite it briefly, and each has a time and a source. The list is chronological, which makes gaps visible: for example, between F6 at 09:31:07 and F7 at 10:02 there is no recorded activity, which students should check rather than assume.

30.4 Answering questions

Q1: phishing email leading to credential theft and a macro document. Q2: the DLL established persistence; its behaviour beyond that is pending static analysis. Q3: 37 messages forwarded; file share access unknown. Q4: no other hosts contacted indicators in the logs examined.

Each answer is short and says what remains open. Q2 waits on static analysis; Q3 gives the count of forwarded messages but cannot cover file share access; Q4 is limited to the logs examined. Students are marked on whether their answers state these limits as clearly as their findings.

30.5 Limits

Each answer carries limits: data searched, time ranges, missing logs.

For Q4, the limit is the proxy export window and the fact that hosts using other egress paths would not appear. For Q3, it is the missing file share logs. Stating limits beside each answer, rather than in a separate list at the end, ensures a reader who looks at one answer also sees what it cannot show. Leah phrases each limit in one sentence that names the data searched.

30.6 Review

Dr Ferreira reviews each student's findings for sources, wording and alternatives.

The review looks for the same issues the checklist covers: is each finding sourced, is the wording calibrated, were alternatives considered? Dr Ferreira returns comments as questions, and students revise and resubmit. The revision history shows how their reasoning improved, which counts toward the final mark. Leah's first draft said the forwarding rule "stole" messages; after review she wrote "forwarded 37 messages to an external address", which states what the audit log shows.

30.7 Assessment

Marks reward correct sourcing and honest limits as much as finding things.

A student who finds all eight findings but overstates conclusions may score lower than one who finds six and states limits clearly. This reflects practice: an overstated report can mislead decisions, while a careful report with gaps can be extended. The rubric is shared at the start of the lab so students know what is valued before they begin the examination. Dr Ferreira also marks the verification table and notes, since they show how findings were reached.

Pair work discipline

Partners share data but not conclusions: each writes findings independently before comparing. Where they differ, both return to the evidence. This mirrors peer review and stops one person's interpretation quietly becoming the pair's.

Worked example

Leah's partner writes F4 as "malware ran". Leah suggests "the memory capture shows EXCEL as parent of cmd, which started rundll32 with update.dll loaded at capture time". The revised wording states exactly what the artefact shows.

Synthetic case. The training image is synthetic.

Errors and limits

A laboratory image is cleaner than real systems; real cases have more noise and gaps.

Exercises

EX088 — Q3 answer. State the answer to Q3 with its limit.
Show marking criteria
Rubric: 3 = 37 messages forwarded; file share unknown (logging off); 2 = one; 1 = wrong; 0 = none.
EX089 — F4 wording. Why is the revised F4 better?
Show marking criteria
Rubric: 3 = states exact artefact and what it shows; 2 = partial; 1 = shorter; 0 = none.
EX090 — Assessment focus. What does the assessment reward besides finding artefacts?
Show marking criteria
Rubric: 3 = sourcing and honest limits; 2 = one; 1 = speed; 0 = none.

Synthesis

A full examination produces sourced findings and bounded answers, reviewed before reporting.

Continue studying — chapter 30 of 40

← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →