◇ OpenCyber Academy
Engineering · Chapter 12 · English

Chapter 12 — Operating systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Operating systems

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Processes and users"]
  N2["12.2 File systems"]
  N3["12.3 User activity artefacts"]
  N4["12.4 Logging"]
  N5["12.5 Live systems change"]
  N6["12.6 Virtualisation"]
  N7["12.7 Privilege"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Processes and users"]
  N2["12.2 File systems"]
  N3["12.3 User activity artefacts"]
  N4["12.4 Logging"]
  N5["12.5 Live systems change"]
  N6["12.6 Virtualisation"]
  N7["12.7 Privilege"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Processes and users]
    |
    v
[12.2 File systems]
    |
    v
[12.3 User activity artefacts]
    |
    v
[12.4 Logging]
    |
    v
[12.5 Live systems change]
    |
    v
[12.6 Virtualisation]
    |
    v
[12.7 Privilege]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) explain processes, users and file systems; (2) identify OS artefacts of user activity; (3) understand logging; (4) explain why live systems change.

12.1 Processes and users

An operating system runs processes on behalf of user accounts. Process lists, parent–child relationships and owning accounts show what ran and under whose authority.

A process tree in which a word processor starts a command shell, which in turn starts a network tool, tells a very different story from the same shell started by an administrator's console. The owning account says whose credentials were in use, not who was at the keyboard. Priya records process ID, parent ID, start time, command line and account for each item, because process IDs are reused and need the other fields to identify a process.

12.2 File systems

File systems such as NTFS, ext4 and APFS store metadata — names, sizes, timestamps, permissions — separately from content. Carrier (2005) organises analysis into categories: file system, content, metadata, file name and application.

The categories help keep an analysis organised. File-system data describes the volume layout, metadata describes each file's attributes, file-name data links names to metadata, content is the data itself, and application data is the meaning a program gives to its files. A deleted file may lose its name entry while its metadata and content survive, which is why recovery tools work in more than one category.

12.3 User activity artefacts

Windows keeps records such as the registry, prefetch files and jump lists; macOS and Linux keep their own logs and histories. Each artefact has specific creation rules that examiners must know before interpreting them.

Prefetch files, for example, suggest that a program ran and record run counts and recent run times, but only if prefetching was enabled and only for a limited history. Jump lists record recently used items per application. The rules for each artefact change between operating-system versions, so Priya keeps a reference sheet listing the version each rule was tested on, and treats untested versions as unknown.

12.4 Logging

System and security logs record logons, service starts and errors. Logs rotate, so older entries disappear.

Rotation might delete the oldest entries once a file reaches a size limit, or keep only a set number of days. A busy server can therefore cover hours while a quiet laptop covers months. The absence of an event means little until Priya knows how far back the log reaches. She records the oldest and newest entries of every log she uses, so the period it can speak about is clear.

12.5 Live systems change

Every action on a running system — even listing files — changes something: access times, memory, logs. NIST SP 800-86 advises weighing the value of live collection against these changes and documenting them.

Running a collection tool loads it into memory, may create prefetch entries and can update access times on files it reads. These changes are usually small and predictable, which is why they are acceptable when the alternative is losing memory contents. The examiner's notes list the commands run, their order and timing, so a later analyst can tell collection artefacts apart from user activity.

12.6 Virtualisation

Virtual machines can be snapshotted, giving a consistent copy of disk and sometimes memory without touching the guest.

A snapshot captures the virtual disk and, if requested, memory at one instant without running anything inside the guest. Snapshot files often depend on a base disk, so both must be preserved together, with hashes for each. Cloud providers offer similar features through their own interfaces. Priya documents which layer produced each artefact, because hypervisor timestamps and guest timestamps come from different clocks.

12.7 Privilege

Administrator accounts can alter logs and timestamps, so evidence of high-privilege activity is examined carefully for consistency.

An administrator can clear event logs, change timestamps with ordinary tools or disable auditing. Each action tends to leave inconsistencies: a log-cleared event, timestamps that fall before the volume was created, or sequence numbers that jump. Priya looks for agreement across independent sources. If one artefact disagrees with several others, the disagreement is itself a finding to report. She also checks whether auditing was switched off shortly before the period in question, since that gap can be as telling as any entry.

Scheduled tasks and services

Persistence often appears as scheduled tasks or services that start automatically. Examiners list them with creation times and owning accounts, then check each against known software before treating any as suspicious; most are legitimate updaters and drivers.

Worked example

A synthetic Windows image shows a program in prefetch with a last-run time, and a logon event for account "mrios" two minutes earlier. Priya notes both, cites the source artefacts, and states that prefetch behaviour depends on OS version and settings, which she records.

Synthetic case. The image is invented.

Errors and limits

Artefact meaning depends on OS version; behaviour documented for one version may not hold for another.

Exercises

Synthesis

Know what the OS records, under what rules, and how your own actions change it.

Continue studying — chapter 12 of 50

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →