Chapter 32 — Digital forensics and malware analysis: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Who is involved"]
N2["32.2 Legal"]
N3["32.3 Data protection"]
N4["32.4 Student services"]
N5["32.5 Communications"]
N6["32.6 Boundaries"]
N7["32.7 Conflicting demands"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Who is involved"]
N2["32.2 Legal"]
N3["32.3 Data protection"]
N4["32.4 Student services"]
N5["32.5 Communications"]
N6["32.6 Boundaries"]
N7["32.7 Conflicting demands"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Who is involved]
|
v
[32.2 Legal]
|
v
[32.3 Data protection]
|
v
[32.4 Student services]
|
v
[32.5 Communications]
|
v
[32.6 Boundaries]
|
v
[32.7 Conflicting demands]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) work with legal, HR, data protection and communications staff; (2) translate technical findings for each; (3) respect role boundaries; (4) handle conflicting demands.
32.1 Who is involved
The ws-114 incident involves the security office, IT operations, the data protection officer, legal counsel, student services and communications. Each needs different information.
Leah's job is to give each group accurate facts at the level of detail it needs. Operations wants to know when ws-114 can return to service; the data protection officer wants to know what personal data left; communications wants wording it can publish safely. A single detailed report would serve none of them well, so the team prepares short notes for each from the same verified findings.
32.2 Legal
Counsel asks whether evidence would stand up if the matter went to court or to a regulator. Leah's team explains acquisition, verification and custody records.
The answer rests on the records built throughout the investigation: the acquisition hash, the verification of each copy, the custody log with seal numbers, and notes made at the time. Counsel can then judge the evidential position without needing to understand the technical detail. Leah also mentions the known limitations, such as the single clock-offset measurement, so counsel is not surprised later.
32.3 Data protection
The data protection officer needs to know what personal data left and when, to decide on notifications. The 37 forwarded messages are reviewed for personal data under her direction.
The review is limited to what the decision needs: whether the messages contain personal data, whose and of what kind. The officer leads it so that the decision on notification rests with the person responsible for it. Leah provides the list of forwarded messages with dates and recipient domains, the same facts that went into Grace's status note to the CIO.
32.4 Student services
s.kaur is a victim; student services offer support and explain what happened in plain terms. Investigators provide facts, not judgements.
Providing facts without judgement helps the student understand what happened and what has been done, such as the password reset and rule removal. Student services can then offer support without needing to interpret technical evidence. Leah's team writes a short plain-language summary for them, checked against the findings, and leaves out details that would only cause worry without helping.
32.5 Communications
Communications staff want a statement. The team supplies verified facts and what is still unknown; wording is the communications team's job.
The worked example shows why this division matters: a draft saying "no data was stolen" would have been wrong, since 37 messages were forwarded. The team's role is to check that any public statement matches the evidence. Communications decides tone and audience; investigators confirm accuracy and flag anything still unknown, such as file share access. The corrected statement in the worked example is the result of exactly this check.
32.6 Boundaries
Investigators do not decide discipline, legal liability or notification; they provide evidence for those who do.
Keeping these boundaries protects the investigation's neutrality. An investigator who also decided discipline might be seen as looking for evidence to support a decision already made. By providing evidence and stating limits, Leah's team lets others make decisions with full information. If asked for an opinion outside their role, they say so and refer the question to the right person, noting the request in the case record.
32.7 Conflicting demands
IT operations want ws-114 back in service; investigators need it preserved. The image is verified, then the machine is released — documented in custody records.
The compromise works because the verified image preserves the disk state, and memory had already been captured. Releasing the machine without verification would risk losing evidence if the image later proved faulty. The custody record notes the date of release and who authorised it, so the gap between seizure and release is accounted for in every later review.
Regulators and law enforcement
If an incident involves crime or reportable breaches, regulators or police may become involved. Legal counsel manages that contact. Investigators prepare evidence so it can be handed over with custody records intact, and they answer questions through the agreed channel.
Worked example
Communications drafts "no data was stolen". Grace corrects: "Some emails were forwarded to an external address before the rule was removed; we are reviewing what they contained. File share access cannot yet be determined." The final statement uses accurate wording.
Synthetic case. The exchange is invented.
Errors and limits
Translating for non-specialists risks losing nuance; check summaries with those who did the analysis.
Exercises
- EX094 — DPO need. What does the data protection officer need from investigators? Rubric: 3 = what personal data left and when; 2 = partial; 1 = everything; 0 = none.
- EX095 — Statement fix. Why was "no data was stolen" corrected? Rubric: 3 = emails forwarded; file share unknown; 2 = partial; 1 = tone; 0 = none.
- EX096 — Boundary. Name a decision investigators do not make. Rubric: 3 = discipline, liability, or notification; 2 = vague; 1 = they decide all; 0 = none.
Synthesis
Investigators serve many partners with accurate facts and clear limits, leaving decisions to those responsible.
Continue studying — chapter 32 of 40
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →