Chapter 36 — Field or community practice | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 36 — Field or community practice

Lesson map

Lesson 36 published. Map, example, EX106.

flowchart TD
  N0["Learning outcomes"]
  N1["36.1 Placement"]
  N2["36.2 Typical requests"]
  N3["36.3 Boundaries"]
  N4["36.4 Preserving evidence for others"]
  N5["36.5 Communication"]
  N6["36.6 Confidentiality"]
  N7["36.7 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX106"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["36.1 Placement"]
  N2["36.2 Typical requests"]
  N3["36.3 Boundaries"]
  N4["36.4 Preserving evidence for others"]
  N5["36.5 Communication"]
  N6["36.6 Confidentiality"]
  N7["36.7 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX106"]

[Learning outcomes]
    |
    v
[36.1 Placement]
    |
    v
[36.2 Typical requests]
    |
    v
[36.3 Boundaries]
    |
    v
[36.4 Preserving evidence for others]
    |
    v
[36.5 Communication]
    |
    v
[36.6 Confidentiality]
    |
    v
[36.7 Reflection]
    |
    v
[Worked example] --> [Exercise EX106]

Learning outcomes

You will (1) apply forensic knowledge in a supervised community setting; (2) give safe, accurate guidance to non-specialists; (3) respect limits of a student role; (4) reflect on practice.

36.1 Placement

Leah volunteers with the university's digital safety clinic, which helps students secure accounts and devices. She works under staff supervision.

The clinic gives Leah practice with real people and their concerns, which the synthetic case cannot provide. Supervision ensures that her advice is accurate and that anything beyond the clinic's role is referred. She keeps a weekly log of the types of requests and the advice given, without personal details. Supervision also gives her someone to ask when a request seems to go beyond what the clinic should handle, which happens in her second week.

36.2 Typical requests

"I think my account was hacked." Leah helps students review sign-in history in their own account settings, change passwords, enable stronger MFA and check forwarding rules — the same artefacts seen in the ws-114 case, viewed by the account owner.

Account owners can see their own sign-in history and rules, so the clinic teaches them to look rather than looking for them. This respects their control over their own accounts. The steps mirror the ws-114 response: check sign-ins, reset the password, enable stronger MFA, remove forwarding rules. The worked example shows a student finding exactly such a rule.

36.3 Boundaries

She does not examine students' devices forensically, access accounts on their behalf, or give legal advice. Suspected crimes are referred to staff, who advise on reporting to police.

These limits keep the clinic within its competence and authority. Forensic examination of a personal device needs authority and proper tools that the clinic does not have. Accessing an account on a student's behalf would blur who did what. Referring suspected crimes to staff ensures the student gets advice from someone who can help with reporting.

36.4 Preserving evidence for others

If a student may report a crime, Leah advises not to delete messages and to take screenshots showing dates, then refers them to staff — guidance that preserves evidence without her collecting it.

The advice protects evidence without Leah touching it. Screenshots should show the date, time and sender, since a cropped image may be hard to use later. Not deleting messages keeps the originals available to police or the university, who can collect them properly. Leah notes in the clinic log that this advice was given.

36.5 Communication

Plain language, no jargon, no blame. She explains what each step does and why.

Explaining each step helps students remember it and repeat it on their own. For example, Leah explains that number-matching MFA asks them to type a code shown on screen, so an unexpected prompt cannot be approved by habit. Avoiding blame matters as much here as in reports: a student who feels judged may not return for help, or may not report the next problem at all, which helps nobody.

36.6 Confidentiality

Clinic notes record advice given, not personal details beyond what staff need.

Recording only the advice given keeps the clinic's records small and less sensitive. If staff need details for a referral, they collect them directly. The log is kept on a restricted share and deleted under the clinic's retention schedule. Leah's weekly summary to staff mentions patterns, not individuals. If a student asks what was recorded about them, staff can show the note, which contains only the advice given and the date.

36.7 Reflection

Her weekly log notes patterns: many compromises follow password reuse; forwarding rules are often missed.

These patterns match what the ws-114 case showed: a forwarding rule after account takeover. Recording them helps the clinic focus its advice: staff use her patterns to update the clinic's handout and add a check of forwarding rules to every account review after a suspected compromise. The password-reuse pattern adds a second line to the handout: use a different password for each account. Leah's reflection also notes how her technical knowledge helped her explain risks simply.

Recognising patterns across visits

Several students in one week report the same fake login page. Leah's clinic notes, kept without personal details, let staff spot the campaign quickly and warn others through official channels.

Worked example

A student reports strange sent emails. Leah guides them to check sign-in history, where they find a sign-in from an unfamiliar location, and a forwarding rule they did not create. They remove the rule, reset the password and enable number-matching MFA. Leah logs the advice and alerts staff to the possible broader phishing campaign.

Synthetic case. The clinic visit is invented.

Errors and limits

Self-service checks show only what the account owner can see; deeper investigation needs authorised staff.

Exercises

EX106 — Student checks. Which account checks did Leah guide? Rubric: 3 = sign-in history, forwarding rules, password, MFA; 2 = two; 1 = one; 0 = none.
EX107 — Crime report. What should a student wanting to report a crime be advised? Rubric: 3 = keep messages, screenshot with dates, refer to staff; 2 = partial; 1 = delete; 0 = none.
EX108 — Boundaries. Name two things Leah does not do. Rubric: 3 = forensic device exams, access accounts for them, legal advice; 2 = one; 1 = vague; 0 = none.

Synthesis

Community practice applies forensic knowledge safely within clear limits, helping people protect themselves and their evidence.

Continue studying — chapter 36 of 40

← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →