Chapter 40 — Thesis and presentation | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 40 — Thesis and presentation

Lesson map

Lesson 40 published. Map, example, EX118.

flowchart TD
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Summary first"]
  N3["40.3 Citation"]
  N4["40.4 Presentation"]
  N5["40.5 Questions"]
  N6["40.6 Connecting the degree"]
  N7["40.7 After graduation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX118"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Summary first"]
  N3["40.3 Citation"]
  N4["40.4 Presentation"]
  N5["40.5 Questions"]
  N6["40.6 Connecting the degree"]
  N7["40.7 After graduation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]

[Learning outcomes]
    |
    v
[40.1 Thesis structure]
    |
    v
[40.2 Summary first]
    |
    v
[40.3 Citation]
    |
    v
[40.4 Presentation]
    |
    v
[40.5 Questions]
    |
    v
[40.6 Connecting the degree]
    |
    v
[40.7 After graduation]
    |
    v
[Worked example] --> [Exercise EX118]

Learning outcomes

You will (1) write the bachelor's thesis as a forensic report plus reflection; (2) present findings to a panel; (3) answer questions with evidence; (4) connect the degree's parts.

40.1 Thesis structure

Summary of findings; scope and authority; evidence inventory; methods and tools; findings with sources; answers to questions with limits; evidence-gap evaluation; recommendations; reflection; appendices (timeline, verification table, archive manifest).

The structure follows the investigation's logic: authority and scope first, then evidence, methods, findings and answers. Appendices hold the detail that supports each claim, so the main text stays readable. A reader can move from a summary statement to its finding and then to the evidence in the appendix, using finding numbers.

40.2 Summary first

Readers such as managers may read only the summary: four questions, four bounded answers, top recommendations.

Leah's summary states the incident, the four answers with their grades, and the three top recommendations, all in under a page. A manager reading only this page can make decisions. Each statement in the summary cites a finding number, so a reader who wants detail knows where to look in the main text. The summary also states the main limits, such as the unknown file share access, so a manager does not read the answers as more complete than they are.

40.3 Citation

Standards and literature are cited: NIST SP 800-86 for process, ISO/IEC 27037 for preservation, ISO/IEC 27042 for interpretation, RFC 3227 for volatility, Carrier (2005) for file-system analysis, Casey (2011) for reasoning, Sikorski and Honig (2012) for static triage.

Each source is cited where it supports a specific method or claim, not as general background. Using primary sources, as she learned in the writing chapter, lets readers check the guidance directly. The reference list includes versions and identifiers, such as DOIs, so readers find the same documents she used.

40.4 Presentation

Fifteen minutes: incident, approach, key findings with evidence, gaps, recommendations. Slides show artefacts, not decoration.

Fifteen minutes allows about three minutes per part. Showing artefacts, such as the process tree and the timeline table, lets the panel see the evidence rather than hear about it. Each slide states its point in a sentence at the top. Leah rehearses with a timer and prepares answers for questions she expects, such as those raised in the seminar about the clock offset and the geolocation limits of F7.

40.5 Questions

A panellist asks: "Could s.kaur have created the forwarding rule herself?" Leah answers: the rule was created three minutes after the foreign sign-in, from that session according to the mailbox audit log; that supports creation by the attacker's session, though the log identifies sessions, not people.

The answer separates what the log shows, a session, from what it cannot show, a person. It uses timing and the audit log's session record as evidence, and states the limit. This is the habit the whole course has built: calibrated claims tied to sources.

40.6 Connecting the degree

Mathematical reasoning shaped summaries; programming built parsers; networks explained proxy evidence; ethics fixed scope; research methods shaped the comparison and sensitivity exercise.

The list shows that each early chapter had a concrete use in the investigation. The base-rate reasoning from statistics explained why one alert was not enough; the privacy chapter shaped the response to the registrar's request. Leah's thesis ends by naming these links, which shows the panel how the degree fits together into one practice of careful, checkable investigation.

40.7 After graduation

Leah applies for an analyst role at the security office.

Her application cites the ws-114 investigation, the tool comparison and her clinic experience, all with evidence from the archive and records. Grace's office knows her work through the capstone supervision. The habits built in the degree, verified copies, sourced findings and stated limits, are exactly what the analyst role requires. She lists in her application the specific evidence for each skill: the verification table, the reviewed report and the clinic log. Whatever the outcome, the archive and thesis remain a record of how she works, which a future employer can examine as readily as Grace did.

Accessibility of the report

Leah checks that figures have text descriptions, tables have headers, and acronyms are spelled out on first use. A reader using a screen reader or printing in black and white loses nothing essential.

Worked example

Her summary's first line: "ws-114 was compromised on 10 February 2026 after a phishing email led to submission of credentials and a macro-enabled spreadsheet; the account s.kaur was then accessed from abroad and 37 messages were forwarded externally before containment at 11:42 UTC."

Synthetic case. The thesis is invented.

Errors and limits

A thesis is assessed as a whole; strong findings do not excuse missing limits.

Exercises

EX118 — Summary role. Why put the summary first? Rubric: 3 = managers may read only it; bounded answers up front; 2 = partial; 1 = style; 0 = none.
EX119 — Rule creator answer. How did Leah answer the forwarding-rule question? Rubric: 3 = created from foreign session 3 min after sign-in per audit log; sessions not people; 2 = partial; 1 = yes/no only; 0 = none.
EX120 — Standards cited. Match three cited sources to their use. Rubric: 3 = e.g. SP 800-86 process, 27037 preservation, RFC 3227 volatility; 2 = two; 1 = one; 0 = none.

Synthesis

The thesis is a complete, sourced forensic report; the presentation defends it with evidence and limits.

Continue studying — chapter 40 of 40

← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →