◇ OpenCyber Academy
Doctoral research · Chapter 2 · English

Chapter 2 — Digital forensics and malware analysis: research frontier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Digital forensics and malware analysis: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Scale and triage"]
  N2["2.2 Fragmentation and carving"]
  N3["2.3 Encryption and cloud"]
  N4["2.4 Mobile devices"]
  N5["2.5 Malware analysis"]
  N6["2.6 Interpretation and evaluative reporting"]
  N7["2.7 Choosing a niche"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Scale and triage"]
  N2["2.2 Fragmentation and carving"]
  N3["2.3 Encryption and cloud"]
  N4["2.4 Mobile devices"]
  N5["2.5 Malware analysis"]
  N6["2.6 Interpretation and evaluative reporting"]
  N7["2.7 Choosing a niche"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Scale and triage]
    |
    v
[2.2 Fragmentation and carving]
    |
    v
[2.3 Encryption and cloud]
    |
    v
[2.4 Mobile devices]
    |
    v
[2.5 Malware analysis]
    |
    v
[2.6 Interpretation and evaluative reporting]
    |
    v
[2.7 Choosing a niche]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map open problems in digital forensics and malware analysis; (2) relate them to standards and published critiques; (3) identify where a doctoral contribution is feasible; (4) avoid topics that require unsafe or unlawful work.

2.1 Scale and triage

Storage volumes grow faster than examiner time. Research asks how to triage — which artefacts to examine first — without missing decisive evidence. Garfinkel (2010) named scale as a central challenge for the following decade. Ines's topic touches triage indirectly. If carving recall is low on fragmented media, an examiner who triages by carving first could wrongly conclude that a picture is absent. Measured recall tells a triage designer how much weight a carving pass deserves before deeper analysis, and on what kind of image that weight was estimated.

2.2 Fragmentation and carving

When file-system metadata is lost, carvers recover files from raw bytes. Carrier's File System Forensic Analysis explains how allocation and fragmentation arise. Header/footer carving fails on fragmented files; smarter reassembly exists but its error rates are rarely reported on shared datasets. This gap is where Ines places her work. Studies often show a reassembly method succeeding on example files but rarely report how many files the method misses across many images with known truth, under each level of fragmentation. Her generator records every fragment's byte range, so recall can be counted rather than estimated from a handful of demonstrations.

2.3 Encryption and cloud

Full-disk encryption and cloud storage move evidence out of reach of traditional imaging. Research examines lawful acquisition routes and what artefacts remain on endpoints. Ines notes this area and leaves it aside. Encrypted volumes and cloud stores raise questions of legal process and key recovery that her generator cannot model, and including them would widen the thesis beyond what eight months of main study allow. Her literature chapter names the area as adjacent work, so examiners can see the boundary was chosen, and it lists the published surveys she read before deciding.

2.4 Mobile devices

NIST SP 800-101r1 describes mobile acquisition levels from manual to physical. Rapid platform changes make validation results age quickly. For a doctoral project this ageing is a risk: a result tied to one phone operating system version may be out of date before the defence. Ines chose disk images partly because carving header/footer patterns in raw bytes depends on file formats that change far more slowly. Her literature review states this reason so the choice is not mistaken for ignorance of mobile work, and it cites SP 800-101r1 for the acquisition levels.

2.5 Malware analysis

Static and dynamic analysis, described in textbooks such as Sikorski and Honig's Practical Malware Analysis, face obfuscation and evasion. Research on behaviour classification and on mapping observed behaviours to ATT&CK techniques continues. Doctoral work here must run in contained laboratories with institutional approval; this book uses only synthetic, inert artefacts. Ines's review covers malware work only to show why she did not choose it. Her topic scoring rated live ransomware clustering low on safety and data access, and the literature confirmed that such studies depend on contained laboratories and samples she could not share. Her thesis keeps the ethical boundary of this book, so it contains no samples at all.

2.6 Interpretation and evaluative reporting

ISO/IEC 27042 covers analysis and interpretation, including repeatability and reproducibility. How examiners express the strength of findings — and how often they agree — is an under-studied area. This links to Ines's results. A recall interval tells an examiner how often a carved file may be missing, but not how to word a report when an expected picture is absent. She cites that gap as future work: a study of how examiners describe partial recoveries and how often they agree on the strength of such findings. Her own thesis gives the error rates that such a study would need as input.

2.7 Choosing a niche

A feasible contribution: narrow (one artefact class), measurable (ground truth available), and safe (no live malware, no personal data). Ines's topic meets all three conditions. It is narrow because it measures one method on one file family. It is measurable because the generator records the truth for every file. It is safe because the images contain no personal data and no malicious code. Her committee accepted the topic on these grounds, while asking her to show that the synthetic images resemble real media in the properties that affect carving.

Worked example

Ines lists five candidate topics and scores each on novelty, feasibility, safety and data access. "Behavioural clustering of live ransomware" scores low on safety and data access. "Carving recall under controlled fragmentation" scores high on all four, and the literature shows few interval-based results on shared synthetic images.

Synthetic case. The scoring is invented.

Errors and limits

Frontier maps date quickly; record the search date and sources.

Exercises

Synthesis

Map the frontier against standards and critiques, then choose a narrow, measurable and safe niche.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →