Chapter 38 — Capstone implementation | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 38 published. Map, example, EX112.

flowchart TD
  N0["Learning outcomes"]
  N1["38.1 Analysis"]
  N2["38.2 Sensitivity exercise"]
  N3["38.3 Decisive evidence"]
  N4["38.4 Archive"]
  N5["38.5 Changes to plan"]
  N6["38.6 Problems"]
  N7["38.7 Supervision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX112"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["38.1 Analysis"]
  N2["38.2 Sensitivity exercise"]
  N3["38.3 Decisive evidence"]
  N4["38.4 Archive"]
  N5["38.5 Changes to plan"]
  N6["38.6 Problems"]
  N7["38.7 Supervision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX112"]

[Learning outcomes]
    |
    v
[38.1 Analysis]
    |
    v
[38.2 Sensitivity exercise]
    |
    v
[38.3 Decisive evidence]
    |
    v
[38.4 Archive]
    |
    v
[38.5 Changes to plan]
    |
    v
[38.6 Problems]
    |
    v
[38.7 Supervision]
    |
    v
[Worked example] --> [Exercise EX112]

Learning outcomes

You will (1) carry out the capstone analysis; (2) run the evidence-gap sensitivity exercise; (3) maintain a reproducible archive; (4) manage changes to plan.

38.1 Analysis

Leah completes the timeline, indicator searches, static triage and verification for ws-114 and the second synthetic host. The second host shows no contact with indicators, consistent with Q4's answer.

The second host acts as a control: its clean result shows that the indicator searches do not produce false matches on a host known to be unaffected. The analysis repeats the earlier labs on the full data with the methods refined by review, such as UTC display in all tools and the clock offset applied consistently.

38.2 Sensitivity exercise

She removes one source at a time and re-derives conclusions. Without proxy logs: the POST to the fake page and the DLL download source are lost; credential theft becomes inference from the foreign sign-in alone. Without memory: the process chain rests on prefetch and run key only. Without identity logs: account takeover cannot be shown.

The results show which sources the conclusions depend on most. The proxy logs carry the most weight: losing them weakens Q1 sharply. Losing memory weakens the process chain but not the persistence finding. Losing identity logs makes Q3's account takeover finding impossible. These results go into the recommendations, which ask for longer log retention.

38.3 Decisive evidence

Q1 depends on proxy and email evidence together. Q3 depends on identity and mailbox audit logs. Q2's persistence finding survives the loss of any single source because disk and memory corroborate.

Q2's persistence finding is robust because disk artefacts and memory independently show the same thing, which is the value of corroboration in practice. Q1 and Q3 each depend on specific sources, so their loss would leave major gaps. This tells the security office which logs to protect most carefully in future incidents.

38.4 Archive

Inputs with hashes, scripts, outputs, notes and the findings table go into a structured archive with a manifest.

The manifest lists every file with its hash, so a reviewer can confirm nothing has changed since submission. Scripts include the date-parsing test added after the mailbox log bug. The structure follows the thesis appendices, so each table in the thesis can be traced to the archive files that produced it. A reviewer who reruns the scripts on the archived inputs should get identical outputs, which Leah checks once herself before submission by running everything from a clean copy.

38.5 Changes to plan

The second host was added late; she records the change and why.

Recording changes lets assessors judge whether they improved the work or drifted from the proposal. Adding the second host strengthened Q4, so the change is justified. The record includes the date of the decision and Dr Ferreira's agreement, and the evaluation chapter discusses it against the original plan. A change that weakened the work, such as dropping a question, would need stronger justification. Keeping a change log through the project makes this discussion easy to write at the end.

38.6 Problems

One script mis-parsed a date format in the mailbox audit log; a test now covers it.

The bug would have shifted mailbox events if not caught, possibly changing the forwarding timeline. Finding it through a mismatch with other sources, fixing it, and adding a test is the same process taught in the programming chapters. The problem and fix are recorded in the archive and mentioned in the evaluation, since they caused the one-week delay to the report draft. Without the test, the same bug could return unnoticed after a later edit.

38.7 Supervision

Fortnightly updates continue; Grace confirms the analysis matches office procedure.

Grace's confirmation matters because the capstone is meant to match how the security office actually works. Regular updates let problems surface early, such as the date-parsing bug, rather than at submission. Each meeting's notes record decisions and actions, and these notes form part of the project record that assessors can read. Supervision also checks that Leah uses only the training data the office provided, keeping the project within its authority.

Final verification

Before writing the report, Leah re-hashes every input in the archive and compares with the manifest. All match. She then reruns every script from a clean copy and confirms the outputs are identical, so the report's tables can be reproduced by anyone with the archive.

Worked example

Leah's sensitivity table row: "Remove identity logs → Q3 'account takeover' cannot be established; forwarding rule remains but its creator cannot be linked to the foreign sign-in." The table shows the security office which logs are most critical to retain.

Synthetic case. The analysis is invented.

Errors and limits

Removing one source at a time does not show combined losses; note that limitation.

Exercises

EX112 — Proxy removal. What is lost without proxy logs?
Show marking criteria
Rubric: 3 = POST to fake page and DLL download; credential theft becomes inference; 2 = partial; 1 = says nothing is lost; 0 = no answer.
EX113 — Robust finding. Which finding survives any single source loss, and why?
Show marking criteria
Rubric: 3 = Q2 persistence; disk and memory corroborate; 2 = partial; 1 = wrong; 0 = none.
EX114 — Practical use. How does the sensitivity table help the security office?
Show marking criteria
Rubric: 3 = shows which logs are critical to retain; 2 = partial; 1 = vague; 0 = none.

Synthesis

Sensitivity analysis reveals which evidence carries each conclusion and guides future readiness.

Continue studying — chapter 38 of 40

← Chapter 37 (draft) · Course chapter index · Chapter 39 (draft) →